iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
North Korean operatives have used stolen identities, forged documents and overseas facilitators to get remote IT jobs with companies around the world. The scheme can expose employers to hiring fraud and, in documented cases, unauthorized access, data theft, malware or extortion. FBI guidance points to practical safeguards: verify identity and device-delivery details, complete background checks before granting system access, and educate third-party staffing firms.
How the scheme works
U.S. authorities describe skilled IT workers concealing their identity, nationality or location to secure remote work. Treasury’s 2026 National Proliferation Financing Risk Assessment says DPRK nationals working from China, Russia and elsewhere used stolen U.S. identities and forged documents to obtain remote employment with companies worldwide. Treasury also describes a Chinese front company and a separate Russia-based scheme.
These schemes can involve facilitators and business entities that help workers appear to be legitimate applicants or contractors. The job itself may be real and the worker may have IT skills; the deception concerns who is doing the work, where they are working from, and the destination of the earnings. The FBI says contract IT work is a common route, making staffing firms and other intermediaries important parts of an employer’s risk picture.
The cited U.S. sources place China and Russia among the recurring locations, while also describing activity in other countries and regions. They do not establish a current independent global headcount, so revenue estimates should not be treated as a measure of how many workers are involved.
#1 Best Overall
Why the schemes matter to employers
The stated financial purpose is to generate revenue for the DPRK regime and its weapons programs. Treasury said on March 12, 2026, that the schemes generated nearly $800 million in 2024. That is Treasury’s estimate for the 2024 reporting period, not a per-worker figure.
A separate upper-end estimate appears in the Justice Department’s 2024 announcement: individual workers could earn up to $300,000 annually, citing the May 2022 interagency advisory. This is not a typical salary or an independently measured average, and it should not be conflated with Treasury’s aggregate 2024 estimate.
Hiring fraud is not the only documented concern. Treasury says some workers have covertly introduced malware into company networks. The FBI has reported observing data exfiltration and data extortion alongside revenue-generation activity. These are documented risks, not evidence that every overseas DPRK IT worker has introduced malware or extorted an employer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.”
Rank #3
U.S. Treasury Secretary Scott Bessent, March 12, 2026
Employer checks that reduce exposure
The FBI’s July 23, 2025 guidance emphasizes checks that establish who is being hired, where the work is being done, and whether access is granted before verification is complete. It specifically recommends background checks before system access, extra documentation to verify an alternate device-delivery address, and education for third-party firms.
| Control area | What to verify | Practical action |
|---|---|---|
| Identity and work history | Whether the applicant’s identity and claimed employment history can be substantiated. | Complete background checks and verify identity and work-history details before granting access to company systems. (FBI, July 23, 2025) |
| Work location and device custody | Whether the stated work and equipment-delivery arrangements are consistent and verifiable. | If a worker requests delivery to an alternate address, verify that address with additional documentation before sending equipment. (FBI, July 23, 2025) |
| Third-party contracting | Whether staffing firms and other contractors understand the threat and follow the employer’s verification expectations. | Educate third-party firms involved in sourcing or managing contract IT workers. (FBI, July 23, 2025) |
| Timing of access | Whether screening is complete before the worker can reach systems or data. | Finish background checks before providing system access; do not let a remote start date substitute for completed checks. (FBI, July 23, 2025) |
These controls are most useful as a coordinated hiring process rather than isolated red flags. A verified identity does not by itself establish a person’s current location or device custody, while contractor oversight cannot replace the employer’s own access checks. The cited FBI guidance supports the checks above; it does not establish a single screening method that guarantees detection.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow to read official warnings and estimates
The FBI’s North Korean IT Worker Threats to U.S. Businesses (July 23, 2025), Treasury’s Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (March 12, 2026), and Treasury’s 2026 National Proliferation Financing Risk Assessment describe different aspects of the threat. The Justice Department’s 2024 case announcement concerns a specific multi-year scheme and its facilitators; it should not be read as a global count or a representative salary survey.
Best Value
The UK government’s advisory, North Korean IT workers advisory: signs to watch for, also reflects a broader regional concern, but its publication date is not established here. Treat it as additional official guidance, not proof of a newly dated change. More broadly, official warnings and enforcement cases document methods and risks; they do not show that every remote worker from China, Russia or another country is suspicious.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
