North Korean IT Workers Forge Identities to Infiltrate Encryption Companies
The U.S. Department of Justice and the FBI have recently taken action against a North Korean remote IT worker scheme, accusing individuals of using stolen or forged identities to obtain remote positions at U.S. and European companies.
These individuals forged resumes, degrees, work experiences, and LinkedIn accounts, and used VPNs and proxies to hide their true locations. During interviews, some utilized AI tools or had others impersonate them. Laptops issued by companies were sent to a "laptop farm" within the U.S., where local accomplices installed remote control software to make the devices appear as if they were located in the U.S.
Once hired, they wrote code, attended meetings, and delivered work on time, with some working for multiple companies simultaneously. As their permissions increased, they gained access to GitHub, Slack, cloud servers, and internal documents. In some cases, after obtaining deployment or wallet-related permissions, they copied source code, customer data, or altered transaction processes.
Documents from the Department of Justice indicate that such schemes have affected over 70 U.S. companies since 2019, spanning the medical, communications, manufacturing, and encryption sectors. The FBI has searched over 40 suspected laptop farms in Texas and other locations, seizing approximately 187 laptops and KVM devices. Two U.S. accomplices have been arrested, and several others have been indicted.
The North Korean government reportedly receives 85% to 90% of the income generated by these workers. In 2024, such remote work is estimated to bring in hundreds of millions of dollars for North Korea, ranking alongside cryptocurrency theft as a source of funding to evade sanctions. After being discovered, some individuals attempted to extort using the stolen data or source code.
Under this mechanism, companies expand remote hiring to reduce labor costs, while there are gaps in identity verification and device location checks. Funds flow to North Korean-controlled entities through accomplice accounts and cryptocurrency channels.
Source: Public Information
ABAB AI Insight
North Korea has systematically trained IT personnel since the 2010s, obtaining foreign currency through overseas dispatch and remote work. The U.S. Treasury and Justice Departments have repeatedly named the Lazarus Group and related entities, identifying remote IT work and cryptocurrency theft as primary means of evading sanctions. In 2024, related income is estimated to reach hundreds of millions of dollars, with some individual workers earning up to hundreds of thousands of dollars annually.
In terms of capital flow, workers receive company equipment through U.S. accomplices and operate remotely, with salaries entering the accomplices' bank accounts before being transferred to accounts in China or cryptocurrency exchanges. The Justice Department has accused some accomplices of charging transfer fees and transferring most of the income out. Cryptocurrency companies have become key targets due to high salaries and opportunities to access assets.
This resembles North Korea's earlier model of dispatching labor overseas, but remote work shifts physical dispatch to digital infiltration. Currently, it is in a phase where the scale of corporate remote hiring expands alongside lagging identity verification technologies.
Essentially, this represents a restructuring of the industrial chain: remote work decouples labor supply from geographic location, allowing state actors to enter corporate systems through identity forgery and device relays. Mechanistically, companies rely on resumes and video interviews to establish trust, while accomplices provide physical addresses and device hosting, continuously concealing true locations and identities; once internal permissions are obtained, the cost of data and asset extraction is far lower than external attacks.
ABAB News · Cognitive Laws
- Remote trust is built on unverifiable identities.
- Devices are local, operators are overseas, and risks have shifted.
- Salaries are the entry point, permissions are the real assets.