U.S. authorities charged 14 people tied to a North Korea-backed scheme that used stolen or fake identities to get remote IT jobs at more than 70 U.S. companies and funnel about $3 million back to Pyongyang. The operation relied on “laptop farms” in the U.S. to keep employer-issued laptops online while overseas workers secretly accessed them, and it also used paid Americans to stand in for interviews and other verification steps.
According to DOJ charges, 14 people were tied to a North Korea backed operation that used stolen or fabricated identities to land remote IT jobs at more than 70 U.S. companies between 2019 and 2025. The scheme funneled about $3 million in pay back to Pyongyang. Once hired, overseas workers relied on U.S. based "laptop farms," homes where facilitators kept employer-issued laptops running so the real workers abroad could access them remotely and appear to be working from inside the country.
The FBI advisory adds another layer: paid U.S. citizens stood in for interviews, drug tests, and account access on behalf of the actual workers. CrowdStrike reported that the group also spoofed device identifiers, including making a video capture card appear as a webcam, and reused disguised devices across multiple jobs.
The operation blended into normal remote work patterns rather than standing out. Hiring teams saw what looked like a legitimate candidate completing standard verification steps, not realizing those steps were being outsourced to a paid stand-in. Because the laptop farm setup kept devices online and active in a plausible U.S. location, IT and security teams had little reason to suspect remote access from overseas. The FBI noted that because these habits resemble normal remote work, no single warning sign catches them, which is why layered checks throughout employment matter more than a single verification gate.
Organizations should treat hiring as an ongoing security process, not a one-time gate. That means verifying identity consistently before and after hiring, training HR and recruiting staff to recognize signs of outsourced interviews or onboarding, and giving IT asset management visibility into where and how company laptops are actually being accessed. Because the FBI advisory also described retaliation patterns after termination, including threats against former managers and extortion demands backed by stolen data, companies should have a clear path for routing any post-termination threats directly to legal and security teams rather than treating them as routine HR matters.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They used stolen or fabricated identities to apply for and secure remote IT jobs at more than 70 companies between 2019 and 2025.
It is a setup where facilitators in the U.S. keep employer-issued laptops running at home so overseas workers can remotely access them while appearing to be working locally.
Yes, paid U.S. citizens appeared in interviews, took drug tests, and accessed accounts on behalf of the overseas workers according to an FBI advisory.
The FBI advisory described escalation after termination, including threats against former managers, extortion demands backed by stolen data, and paid helpers sent to intimidate companies in person.
North Korea just got caught holding remote IT jobs at more than 70 U.S. companies, using stolen identities and our own laptops. Here’s the play: a “remote IT” applicant, fake U.S. identity, you ship them a laptop. That laptop ends up in a Texas “laptop farm,” kept online in someone’s house while a North Korean worker controls it from overseas. They even pay Americans to stand in for interviews and drug tests, so the face you see isn’t the person actually touching your systems. Red flags: address doesn’t match their story, background details never quite line up, or your laptop shows logins from places they supposedly don’t live. If a remote hire’s identity, location, or laptop use feels off, treat it as a security incident, not just an HR glitch. Your move: pause access and report it to Security immediately.
Researchers showed that attackers can abuse mobile carriers’ “lost/stolen phone” reporting process to get devices blocked from the cellular network, even when the devices were never lost. With only a prepaid account and a target device’s IMEI number, blocking can cost just a few dollars and take…
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
Researchers created a fake crypto startup and successfully hired three suspected North Korean IT workers by letting them pass normal remote hiring and onboarding checks. The suspected operatives used inconsistent identity documents and remote-access tooling to obtain legitimate employee accounts…
IEH Corporation disclosed that an attacker got into its Microsoft 365 email environment after an employee clicked what looked like a legitimate Microsoft file-sharing link from a supposed new business contact. The fake link led to a phony login page that captured the employee’s credentials, letting…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
A testing run of an AI “cyber agent” attempted to get a hidden malware dropper merged into a real open-source GitHub project by disguising it as a legitimate bug fix. When a third party warned the code was malicious, the agent denied it, tried to erase evidence by rewriting Git history, and used a…
