North Korean IT Worker Schemes: What Employers and Government Contractors Should Know

On October 13, 2026, the U.S. Department of Justice announced coordinated enforcement actions targeting North Korean remote IT worker schemes. The actions included arrests, an indictment, searches of suspected “laptop farms” and the seizure of approximately 187 computer devices. DOJ said the schemes affected more than 70 U.S. companies. The cases underscore a risk for organizations that hire remote technology workers or rely on outside staffing and IT vendors: a person who appears to be a qualified U.S.-based applicant may be using a stolen or fabricated identity on behalf of North Korean networks.

The alleged objective is not simply to obtain a paycheck. Revenue generated through these placements can support the North Korean regime and its prohibited programs. Once hired, workers may also gain access to internal systems, source code, customer information, credentials or other sensitive business data. The FBI has warned that some schemes have involved theft of proprietary information and extortion.

How the schemes work

According to U.S. government advisories and recent cases, individuals may apply using stolen identities, fabricated credentials, alias email accounts and misleading online profiles. They may use VPNs, proxy infrastructure or remote-access arrangements to make it appear they are working from a U.S. location. In some cases, people in the United States help receive company laptops, establish internet connections, create accounts or otherwise facilitate the arrangement. Some facilitators may knowingly assist; others may be misled.

A company may therefore ship a device to a seemingly legitimate worker while the person actually operating it is elsewhere. The person who passes the interview may not be the person doing the work. In addition, a staffing supplier or subcontractor can create distance between the employer and the person ultimately accessing company systems. The FBI has specifically cautioned businesses to assess third-party hiring and remote IT arrangements, not only direct hires.

Why government contractors should pay attention

Small and mid-sized government contractors can be attractive targets because they often need specialized technical talent, work with subcontractors and support distributed teams. A fraudulent placement may create several overlapping risks: unauthorized access to government-contract information, exposure of controlled or proprietary data, credential theft, intellectual-property loss, sanctions concerns, disruption to contract performance and reputational damage. Whether a particular incident triggers a contractual or regulatory reporting duty depends on the contract, data involved and applicable requirements; organizations should involve their security, contracts and legal teams promptly rather than assume one reporting rule fits every situation.

The risk is not limited to classified work or large defense companies. Any organization that provides access to business networks, code repositories, cloud services or client environments should consider how it verifies the identity and location of remote workers and how it limits access after onboarding.

Practical steps to reduce risk

Strengthen identity verification at several points—not only when an offer is made.

Verify identity documents and compare the applicant’s name, photograph, contact information, employment history and education using independent sources.
Check for repeated resumes, email addresses, phone numbers, banking details or other information across apparently unrelated applicants.
Where feasible and appropriate, use live video verification and in-person steps for roles with elevated access.
A mismatch is a reason to pause and verify, not to make assumptions based on nationality, accent or other protected characteristics.

Control equipment and access.

Send company devices only to a verified address and require additional review if an applicant requests a last-minute shipping change or a third party to receive equipment.
Do not grant production, customer or sensitive-data access before required identity and background checks are complete.
Use least-privilege permissions, restrict local administrator rights and limit installation of remote-access tools.
Monitor for unusual logins, geographically inconsistent connections, unexpected remote desktop software, repeated account changes, or unusual transfers to personal cloud storage and code repositories.

Review vendors and subcontractors.

Ask staffing firms how they verify identity, confirm the actual worker assigned to a role and prevent undisclosed substitution or subcontracting.
Make sure contracts establish appropriate security expectations, audit rights and escalation procedures.
For higher-risk IT roles, consider periodic identity checks and confirm that the person performing the work is the person approved by the company.
Train recruiters, HR, hiring managers and IT/security staff together so warning signs are not treated as isolated administrative issues.

If you suspect a fraudulent placement

Escalate concerns immediately to information security, HR, legal and the contract/security lead.
Preserve relevant hiring records, messages, device information and access logs.
Avoid alerting a suspected actor in a way that could compromise an investigation.
Security staff should assess whether credentials need to be disabled, sessions revoked, devices isolated or data access reviewed, while preserving evidence and maintaining business continuity.

The FBI recommends reporting suspected North Korean IT worker activity to the local FBI field office and the Internet Crime Complaint Center (IC3). Contractors should also review any applicable contract clauses, incident-response plans and customer notification requirements with the appropriate internal teams. Report suspected activity based on the facts and applicable obligations, not on a single indicator alone.

Bottom line

Remote hiring controls are now part of both workforce risk management and cybersecurity. Contractors do not need to abandon remote work, but they should verify identity and work location, scrutinize third-party arrangements, limit access to what each worker needs, and monitor for suspicious activity throughout employment—not just at the application stage.