North Korea Recruits Overseas Talent to Infiltrate Companies Through IT-Worker Fraud

A multinational government alert warns that North Korean IT workers are fraudulently securing remote jobs at companies worldwide using stolen or fabricated identities, forged documents, interview proxies, VPNs, remote-desktop tools, and overseas laptop farms. The activity generates revenue for Pyongyang's prohibited nuclear-weapons and ballistic-missile programs, while potentially exposing employers to sanctions violations and insider threats including data theft, cryptocurrency theft, and exfiltration of sensitive information.

Reporting indicates North Korea is also recruiting talent abroad to expand infiltration of U.S. companies and facilitate associated money-laundering activity. Employers, staffing firms, and online work platforms should strengthen identity and right-to-work verification and investigate anomalies in interviews, account activity, device locations, payment methods, and requests to route company laptops through third parties; UN Security Council Resolution 2397 generally requires states to repatriate North Korean nationals earning income in their jurisdictions.