North Korean IT Workers Infiltrate US Companies via Laptop Farms and Stolen Identities
North Korean operatives exploited weak identity verification processes during remote hiring to place fraudulent workers inside US companies, gaining direct access to corporate systems and sensitive data. By routing employer-issued laptops through US-based 'laptop farms,' they bypassed geographic sanctions controls and obscured their true locations. This scheme demonstrates that insider threats can be deliberately engineered through the hiring supply chain, not just arise organically. The operation impacted at least 70 companies and generated millions in revenue for a sanctioned nation-state, making it both a cybersecurity and national security failure. Organizations that rely solely on self-reported identity information during remote onboarding are especially vulnerable to this class of attack.
Tactical Insight
Immediate actions
- Verify the physical location of all remote employees by cross-referencing IP addresses, shipping addresses, and government-issued ID documents through a trusted third-party identity verification service.
- Audit all currently active remote workers for signs of anomalous access patterns, VPN usage inconsistencies, or redirected device shipment addresses.
- Report suspected DPRK IT worker activity to the FBI's Internet Crime Complaint Center (IC3) and OFAC immediately.
Long-term improvements
- Implement a formal vendor and contractor vetting process that includes background checks, biometric verification, and sanctions screening (OFAC, SDN list) before onboarding any remote worker.
- Establish a hardware deployment policy requiring laptops to be shipped only to verified, pre-approved addresses with in-person activation or video-confirmed receipt.
- Integrate supply chain risk management into HR and procurement workflows to flag high-risk hiring patterns, such as multiple contractors sharing payment accounts or addresses.
Detection measures
- Deploy endpoint telemetry and Device-as-a-Service (DaaS) controls to alert on unusual remote access tools (e.g., KVM-over-IP, remote desktop proxies) that may indicate a laptop farm setup.
- Monitor for logins occurring outside of declared work hours or from IP geolocation inconsistent with the employee's stated location, and trigger automatic account review.
- Conduct periodic live video check-ins with remote contractors that require them to display their surroundings and government ID to confirm physical identity.