North Korean IT Job Fraud Used Stolen Identities

A U.S. defense contractor employee admitted helping a North Korean remote-worker operation by allowing foreign workers to use his identity to apply for remote jobs. The operation secured nine job offers from U.S. companies and relied on identity impersonation and employer-provided laptops hosted at the accomplice’s home.

Key findings

• A defense contractor employee with Top Secret clearance pleaded guilty to helping a North Korean remote IT-worker scheme.
• Foreign individuals used his identity, as well as another person’s identity, to apply for remote positions at U.S. companies.
• The fraudulent applications resulted in nine job offers.
• The accomplice hosted victim companies’ laptops at his home, helping workers appear to be located in the United States.
• OFAC also sanctioned people and an entity allegedly supporting North Korean IT-worker operations and movement of their cryptocurrency earnings.

Who’s being targeted

• Commonly targeted roles: Recruiting, Human Resources, Hiring Managers, IT Support, IT Asset Management, Security Operations, Remote Workforce Managers.
• Affected industries: Organizations hiring remote IT workers, Defense contractors, U.S. companies with remote-work programs.
• Attack channels: website.
• Impersonated: A legitimate U.S. job applicant.

Awareness takeaways

• Independently verify the identity, location, and work eligibility of remote hires before granting access or sending corporate equipment.
• Treat requests to route, host, or operate company laptops through another person or address as a high-risk warning sign requiring investigation.
• Coordinate HR, IT, legal, and security checks for remote hires, especially before issuing devices or access to sensitive systems.

Red flags to watch for

• The applicant’s identity, physical location, and device destination do not align.
• The employee asks for company equipment to be sent to, accessed from, or hosted by another person.
• Identity verification relies only on documents or remote communications supplied by the applicant.