CISOs looking for new IT hires already struggle with talent market shortages and bridging cybersecurity skills gaps. But now they face a growing challenge from an unexpected source: sanctions-busting North Korean software developers posing as potential hires.
North Korea is actively infiltrating Western companies using skilled IT workers who use fake identities to pose as remote workers with foreign companies, typically but not exclusively in the US.
These North Korean IT workers use fake identities, often stolen from real US citizens, to apply for freelance contracts or remote positions.
Estimates of the extent of the crime are hard to come by, but a United Nations Panel of Experts report last year estimated 3,000 North Korean IT workers abroad — often in either China or Southeast Asia — and another 1,000 more operating inside North Korea were generating between $250 million and $600 million per year.
The schemes — effectively a state-sanctioned crime syndicate — are part of illicit revenue generation efforts by the North Korean regime, which faces financial sanctions over its nuclear weapons program, as well as a component of the country’s cyberespionage activities.
Recent examples of the trend have included the use of deepfake technologies, extortion scams, and increased expansion into Europe. In 2025, DPRK agents expanded their focus to include cybersecurity roles, and they increased the use of female personas, the Sophos Counter Threat Unit Research Team reports.
Multimillion-dollar fake worker cell busted
The US Treasury department first warned about the tactic in 2022. Thousands of highly skilled IT workers from North Korea are taking advantage of the demand for software developers to obtain freelance contracts from clients around the world, including in North America, Europe, and East Asia.
“Although DPRK [North Korean] IT workers normally engage in IT work distinct from malicious cyber activity, they have used the privileged access gained as contractors to enable the DPRK’s malicious cyber intrusions,” the Treasury department warned.
“These IT workers often rely on their overseas contacts to obtain freelance jobs for them and to interface more directly with customers,” it adds.
North Korean IT workers present themselves as South Korean, Chinese, Japanese, or Eastern European, and as US-based teleworkers.
DPRK freelancers are using front companies — posing as software development or tech consulting firms — in China, Russia, Southeast Asia, and Africa to mask identities and secure jobs in Western companies, according to research by SentinelOne.
In the years since the Treasury department’s first warning, examples of the ruse in action are increasingly emerging, not least through ongoing prosecutions.
For example, Christina Chapman, of Litchfield Park, Ariz., was jailed in July 2025 following her conviction for fraud, identity theft, and money laundering charges for orchestrating an elaborate scheme that enabled North Korean IT workers to pose as US citizens and residents using stolen identities to obtain jobs at more than 300 US companies and two international firms. The conspiracy generated more than $17 million in illicit revenue over the course of three years between October 2020 and October 2023.
US payment platforms and online job site accounts were abused to secure jobs at a wide range of companies, including a major TV network, a car manufacturer, a Silicon Valley technology firm, and an aerospace company. “Some of these companies were purposely targeted by a group of DPRK IT workers,” according to US prosecutors, who add that two US government agencies were “unsuccessfully targeted.”
Chapman ran a “laptop farm,” hosting the overseas IT workers’ computers inside her home so it appeared that the computers were located in the US. The 50-year-old received and forged payroll checks, and she laundered direct debit payments for salaries through bank accounts under her control.
Much of the $17.1 million received from the work was falsely reported to tax authorities using the stolen identities of 68 US citizens.
The case is only the most high profile of several US prosecutions (examples here and here) involving North Korean IT worker scams.
Tradecraft
Insider risk management firm DTEX reports that the techniques leveraged by DPRK agents to evade detection have evolved, reducing reliance on traditional “laptop farms,” to include tactics such as:
Disabling secure access service edge tools (e.g., Zscaler/Netskope) to create a more permissive environment for remote access tools.
Abusing privileged access from one organization to infiltrate another. This often involves VDI web-based applications such as VMware Horizon and Citrix XenDesktop.
An investigation by threat intel agency Flashpoint uncovered additional details on the tactics and procedures used by North Korean threat actors.
It confirmed findings by US prosecutors that fake US companies, including Helix and Baby Box, were used to embellish resumes and provide fake references.
Emails from the bogus companies were tied to a compromised host located in Lahore, Pakistan. The Korean language input method was installed alongside a Chinese time zone setting on this host.
Flashpoint’s researchers infiltrated this host, finding numerous saved credentials from various corporate human resources sites and job boards, indicating that it had been used intensively to apply to dozens of tech jobs throughout 2023.
The researchers found Google Translate URLs capturing dozens of translations between English and Korean.
The researchers also uncovered numerous messages containing advice and tradecraft, such as discussions of how to persuade a manager not to require use of a camera during meetings and about voice manipulation or dubbing.
“Some of the messages also expressed frustration and disappointment directed at a remote worker participating in the scheme, observing that they had failed to find new jobs and, in one case, may have been found out,” Flashpoint reports.
KnowBe4 gets a lesson in security awareness
How this type of malfeasance plays out from the perspective of a targeted firm was revealed by security awareness vendor KnowBe4’s candid admission in July 2024 that it unknowingly hired a North Korean IT spy.
The new hire was promptly detected after he infected his work laptop with malware before going to ground when the incident was detected and refusing to engage with security response staff.
The software engineer, hired to join KnowBe4’s internal IT AI team, passed video-based interviews and background checks. The “job seeker was using a valid but stolen US-based identity.” Crucially, it subsequently emerged, the picture on the application was “enhanced” using AI tools from a stock image photo.
The new hire had failed to complete his induction process, so he had no access to KnowBe4’s systems; as a result, no data breach occurred. “No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems,” according to the vendor, which is treating the whole incident as a “learning experience.”
‘Thousands’ of North Korean IT workers seeking jobs
A growing and substantial body of evidence suggests KnowBe4 is but one of many organizations targeted by illicit North Korean IT workers.
Mandiant, the Google-owned threat intel firm, reported last year that “thousands of highly skilled IT workers from North Korea” are hunting work.
“These workers acquire freelance contracts from clients around the world … although they mainly engage in legitimate IT work, they have misused their access to enable malicious cyber intrusions carried out by North Korea,” according to Mandiant.
Email addresses used by Park Jin Hyok (PJH), a notorious North Korean cyberspy linked to the development of WannaCry and the infamous $81 million raid on Bangladesh Bank, appeared on job sites prior to Park’s US indictment for cybercrimes. “In the time between the Sony attack [2014] and the arrest warrant issued, PJH was observed on job seeker platforms alongside [other North Korean] DPRK’s IT workers,” according to Mandiant.
CrowdStrike reported that a North Korean group it dubbed “Famous Chollima” infiltrated more than 100 companies with imposter IT pros. Phony workers from the alleged DPRK-nexus group, whose targets included aerospace, defense, retail, and technology organizations predominantly in the US, performed enough to keep their jobs while attempting to exfiltrate data and install legitimate remote monitoring and management (RMM) tools to enable numerous IP addresses to connect to victims’ systems.
Suspected North Korean faux IT workers unsuccessfully tried to use deepfake video technology in a job interview with security vendor Exabeam. The ruse was easily detected, but as AI technology evolves such schemes will only become harder to detect, Exabeam CISO Kevin Kirkwood warned.
Threat intel firm Secureworks noted in its 2024 State of the Threat report that fake IT worker scams are evolving, as the firm detected multiple attempts by fraudulent workers to demand extortionate payments after the theft of proprietary or sensitive information after they were hired by victim companies.
Crossing continents
North Korean IT worker scams are also expanding into Europe.
While the US remains a prime target, increased obstacles due to a combination of law enforcement action and greater awareness, have prompted scammers to target European businesses, according to research from Google.
For example, suspected DPRK workers have undertaken UK projects in areas such as web development, bot development, content management system (CMS) development, and blockchain technology.
This indicates a “broad range of technical expertise, spanning traditional web development to advanced blockchain and AI applications,” according to Google.
Separate investigations have uncovered IT worker personas seeking employment in Germany and Portugal.
DPRK IT workers are obtaining work through various online platforms, including Upwork, Telegram, and Freelancer. Payment was sought through various means, including cryptocurrency, the Wise money transfer service, and Payoneer.
Extortion playbook
Google adds that the previously identified tactic of post-employment extortion attempts by DPRK IT worker crews has ramped up.
“Recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor,” Google researchers reported. “This data included proprietary data and source code for internal projects.”
Previously, DPRK IT workers terminated from their places of employment might seek to obtain references or attempt to get rehired, but law enforcement action and greater awareness has prompted some groups to adopt more aggressive measures, according to Google. North Korean groups have begun to conduct operations within corporate virtualized infrastructure, Google warned in April.
Detection is ‘challenging’
Using chatbots, “potential hires” are perfectly tailoring their resumes, and further leverage AI-created deepfakes to pose as real people.
North Koreans operatives commonly use face-changing software during video interviews or rely on AI assistants to help answer questions in real-time.
Crystal Morin, former intelligence analyst for the US Air Force turned cybersecurity strategist at Sysdig, told CSOonline that North Korea is primarily targeting US government entities, defence contractors, and tech firms hiring IT workers.
“Companies in Europe and other Western nations are also at risk,” according to Morin. “North Korean IT workers are trying to get jobs either for financial reasons — to fund the state’s weapons program — or for cyberespionage.”
Morin added: “In some cases, they may try to get jobs at tech companies in order to steal their intellectual property before using it to create their own knock-off technologies.”
“These are real people with real skills in software development and not always easy to detect,” she warned.
Countermeasures
IT managers and CISOs need to work with their colleagues in human resources to more closely vet applicants. Additional technical controls might also help.
Here’s some suggestions for recommended process improvements:
Conduct live video-chats with prospective remote-work applicants and ask them about their work projects
Look for career inconsistencies in resumes or CVs
Check references by calling the referee to confirm any emailed reference
Confirm supplied residence address
Review and strengthen access controls and authentication processes
Monitor supplied equipment for piggybacking remote access
Post-hire checks need to continue. Employers should be wary of sophisticated use of VPNs or VMs for accessing company system, according to KnowBe4. Use of VoIP numbers and lack of digital footprint for provided contact information are other red flags, the vendor added.
David Feligno, lead technical recruiter at managed services provider Huntress, told CSOonline: “We have a multiple-step process for trying to verify if a background looks too good to be true — meaning is this person stealing someone else’s profile and claiming as their own, or simply lying about their current location. We first check if the candidate has provided a LinkedIn profile that we can review against their current resume. If we find that the profile location does not match the resume — says on resume NYC, but on LinkedIn profile says Poland — we know this is a fake resume.
“If it is the same, did this person just create a LinkedIn profile recently and have no connections or followers?”
Huntress also checks that an applicants’ supplied phone number is valid, as well as running a Google search on them.
“All of the above will save you a great deal of time, and if you see anything that does not match, you know you are dealing with a fake profile, and it happens a lot,” Feligno concluded.
Brian Jack, KnowBe4’s CISO, agrees that fake remote employees and contractors are something every organization needs to worry about, adding: “CISO’s should review the organization’s hiring processes and ensure that their overall risk management practices are inclusive of hiring.”
Hiring teams should be trained to ensure they are checking resumes and references more thoroughly to be sure the person they are interviewing is real and is who they say they are, Jack advises. Best would be to meet candidates in person along with their government-issued ID or using trusted agents, such as background checking firms — especially as use of AI enters into the mix of hiring schemes such as these.
“One thing I like to do as a hiring manager is ask some questions that would be hard to prepare for and hard for an AI to answer on the fly, but easy for a person to talk about if they were who they claim to be,” Jack says.
No Responses