FBI
Public Service Announcement
Alert Number: I-101326-PSA | 13 October 2026
North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
The Democratic People's Republic of Korea (North Korea) continues to improve its tactics to infiltrate western companies with thousands of state-controlled remote "IT Workers" (ITWs) while avoiding detection. ITWs are increasingly using facilitators to counter improved private sector detections and law enforcement actions. The FBI has observed North Korean ITWs use stolen identities, extort victims, and use threats of physical violence to demand payments. ITWs fund North Korea's government, including its nuclear weapons and other military programs, and pose a significant national security and intellectual property theft insider threat.
The FBI is updating its previous guidance to the public and private sector on techniques and recommendations to identify and avoid this threat. This includes tips to protect yourself and your business, as well as a larger description of how the threat has recently evolved.
The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress. ITWs are paying Americans for an expanding range of services to hide their own involvement in the scheme, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences. These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny.
U.S. companies should recognize the scale, persistence, and rapid evolution of the North Korean ITW threat means ITWs cannot be identified reliably with a single indicator. Mirroring cybersecurity concepts, detection requires an "identity in depth" approach for effective defense, consisting of multiple layered access controls and detections throughout the employment lifecycle to find, interdict, and remove ITWs regardless of North Korean tactical innovations.
Tips to Protect Yourself as an Individual
For the public, the FBI provides the following information and general recommendations to prevent falling victim to the North Korean ITW scheme.
- Be aware North Korean ITWs post fake job openings on well-known job boards often as freelance gigs with simple requests such as interviewing on someone's behalf or receiving and hosting laptops in your home.
- ITWs routinely invent elaborate stories, create fake companies, and produce official documentation to lend credibility to their requests. Common ITW backstories include claiming to be Chinese or East Asian nationals in need of a temporary U.S. presence or claiming to be Eastern Europeans displaced by the ongoing Russia-Ukraine war.
- Reject any request to provide personal information, personal details, financial information, or personal account logins in exchange for payment.
- Be aware ITWs have used threats of violence and other acts of intimidation to try to compel Americans to continue illicit activities. If you or someone you know receives a threat to life or is concerned about physical safety, call 911.
Tips to Protect Your Business — Identity in Depth
For companies, the FBI notes North Korean ITWs cannot be identified reliably with a single indicator or detection given the diversity of their activity and significant signature overlaps with legitimate remote employment. Finding ITWs in applicant pipelines or on corporate networks requires examining multiple compounding behaviors that may be innocuous individually, but when considered together are highly suggestive of malicious activity. Listed below are ITW behavioral tendencies and general recommendations.
- ITWs continue to use remote desktop software to connect to employment-related devices. Examples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.
- ITWs use external hardware such as TinyPilot, PiKVM, GL.iNet, and other Keyboard Video Mouse (KVM) over IP devices to control laptops. ITWs have also purchased and used separate laptops to remote into and control employer-provided devices.
- ITWs frequently download applications outside of, or unconnected to their job role on work devices. ITWs abuse open-source software, such as "OBS Studio" with a "VDO.Ninja" plugin (formerly "OBS.Ninja") to establish remote connections, and Homebrew for package management.
- ITWs almost always exfiltrate data since most are mandated to record their screens to track their daily work activity. These recordings are produced on the ITW's device, which can be multiple connections removed from the employer-provided device.
- ITWs tend to rotate through bank accounts, street addresses, social media accounts or other identifiers at an unusually high rate due to account bans and other disruptions.
- ITWs forge verification documents for stolen identities when applying for employment. Using E-Verify, requiring a U.S. passport, multiple forms of identification, or live verification can raise friction for ITWs. Relying solely on "ban lists" or filtering out ITW associated names can be unreliable, block qualified applicants, and risks negatively impacting potential victims of identity theft.
- Cross-functional collaboration between internal teams enhances detection effectiveness. Information technology, human resources, security, and management personnel all have unique insights that when combined can more effectively enumerate ITW activity.
- Implementing aggressive controls against North Korean ITWs presents unusually high risks of generating false positives that could harm legitimate employees and filter out qualified applicants. Balancing the need to disrupt ITWs while supporting legitimate remote employment requires careful detection calibrations, substantive review, and continuous refinement based on observed outcomes.
"Identity in Depth" — layered detections, access controls, and continuous identity verification throughout employment — avoids unreliable filters while enabling moderate, weak, or unavoidable signals to justify enhanced scrutiny when aggregated together. Evaluating identity-related fraud based on probabilistic behavioral data rather than easily bypassed rules provides defenders the resilience and flexibility necessary to counter North Korean ITWs and their ongoing tactical advancements.
Evolution of North Korean IT Worker Tactics
continued: https://www.ic3.gov/PSA/2026/PSA261013
www.zerohedge.com
