Loading story…
The FBI is investigating how a North Korean national using a fraudulent identity was hired as a remote IT worker for an unnamed U.S. federal agency, marking a notable expansion of a scheme that has more commonly targeted private companies. Authorities say these operations use fake personas to secure remote jobs, generate revenue for Pyongyang, and in some cases steal data, intellectual property, or extort employers; it remains unclear which agency was affected in this case or whether any government data or funds were compromised.
The case follows earlier U.S. enforcement against facilitators who helped North Korean operatives penetrate American organizations, including a Justice Department prosecution of a Maryland man tied to a contractor role supporting the Federal Aviation Administration. Security researchers and industry reporting say the broader pattern increasingly exploits hiring, contractor onboarding, delegated access, and supplier trust relationships rather than relying solely on phishing or malware, exposing gaps across HR, procurement, identity and access management, finance, asset management, and security teams.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
On July 31, U.S. agencies and more than a dozen foreign partner agencies issued a global alert warning that North Korean remote IT workers pose risks to private companies, governments, and individual citizens. The alert expanded official warning of the scheme beyond the previously disclosed federal-agency investigation.
At a conference in Washington, D.C. on July 28, a senior FBI official said the FBI is investigating how a North Korean national was hired by an unnamed U.S. federal government agency. The affected agency was not publicly identified, and it remained unclear whether any data or funds were stolen.
In June 2025, Nisos said a suspected North Korean operative applied for a remote AI architect role using a stolen identity, prompting an investigation. Nisos reported finding signs of AI-assisted interview responses and traced the operation to a U.S.-based laptop farm using PiKVM devices and a Tailscale mesh VPN to support multiple fraudulent worker personas.
In March 2025, Nisos reported a likely North Korean-affiliated IT worker network that used GitHub personas posing as Vietnamese, Japanese, and Singaporean nationals to seek remote engineering and blockchain developer jobs in Japan and the United States. Nisos said two personas appeared to have obtained employment at companies with fewer than 50 employees and assessed the scheme was intended to generate revenue for Pyongyang.
Between late 2024 and early 2025, a PurpleDelta cluster linked to North Korean IT-worker activity applied to jobs at more than 1,100 companies using at least 22 fabricated personas and was assessed as highly likely to have gained employment at at least ten organizations. Recorded Future said the operators, likely based in China, used AI-generated profile photos, custom ChatGPT assistants, illicit identity documents, and facilitators handling company-issued hardware.
In 2024, the U.S. Justice Department charged a Maryland man who helped a North Korean operative pose as an American to obtain remote employment. The operative secured a contractor role tied to the Federal Aviation Administration.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
10 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecuritymagazine.com
Open sourcebsky.app
Open sourcetechcrunch.com
Open sourcefederalnewsnetwork.com
Open sourceinfosecurity-magazine.com
Open sourcejustice.gov
Open sourcenisos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Aug 18, 2026
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026
The U.S. State Department, FBI, and allied governments warned that North Korean IT workers are obtaining freelance and full-time jobs at companies worldwide by using stolen identities, forged documents, proxy interview participants, VPNs, remote desktop tools, and overseas **"laptop farms"** that make them appear to be operating from trusted jurisdictions. Authorities said the workers funnel wages and cryptocurrency payments back to Pyongyang, helping fund North Korea’s nuclear weapons and ballistic missile programs while exposing employers to insider threats including **data exfiltration, credential theft, and cryptocurrency theft**. The warning builds on earlier reporting and government actions showing that DPRK-linked workers have infiltrated Western technology and cryptocurrency firms under false identities, sometimes through front companies and facilitators based in **Russia and China**. Researchers and prior U.S. cases have tied the scheme to broader risks beyond sanctions exposure, including potential malware deployment, espionage, disruption, and money laundering, prompting officials to urge stronger identity verification, closer scrutiny of interviews and payment arrangements, monitoring for anomalous account activity, and rapid reporting of suspected hires.
Aug 6, 2026