[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foXTgSdeftHl9PhaHt4KYvF7IIpMYdUpCi6ifXMMnmJo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"410f06cc-012d-4647-b591-2b5c2bccb3d5","north-korean-remote-work-fraud-identity-theft-funds-weapons-programs","f90c35b4-fc01-4bda-82e9-45ef28f255bc","North Korean Remote Work Fraud: Identity Theft Funds Weapons Programs","This case exposes a sophisticated identity fraud scheme where stolen identities enabled North Korean nationals to infiltrate over 70 U.S. companies as remote workers, channeling $3 million to Pyongyang. The root failure lies in weak employee identity verification processes during hiring, combined with poor insider threat awareness among HR and IT teams. Physical 'laptop farms' operated undetected because companies lacked controls to verify the true geographic location of remote workers using their issued equipment. This matters not only because it violates U.S. sanctions law but because these workers likely had privileged access to sensitive company systems and intellectual property.","**Immediate actions:**\n- Implement multi-factor, in-person or video-verified identity proofing for all new remote hires before granting system access.\n- Audit all current remote employees for inconsistencies such as mismatched IP geolocation, VPN usage patterns, or unusual device login behaviors.\n\n**Long-term improvements:**\n- Establish a formal insider threat program that trains HR, IT, and managers to recognize red flags such as reluctance to appear on video, unusual working hours, or requests to redirect paychecks.\n- Partner with background check vendors who perform biometric or government-ID validation, especially for roles with access to sensitive systems or data.\n- Enforce a Mobile Device Management (MDM) policy that continuously reports device geolocation and flags VPN or proxy usage on employer-issued hardware.\n\n**Detection measures:**\n- Deploy User and Entity Behavior Analytics (UEBA) to flag anomalous login times, access patterns, or data exfiltration consistent with overseas activity.\n- Require periodic live video check-ins with webcam and a valid government ID displayed as an ongoing condition of remote employment.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-12: Identity Proofing","NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-207: Zero Trust Architecture","NIST CSF ID.AM-6: Cybersecurity roles and responsibilities","ITIL Service Transition: Access Management","Executive Order 13694: Sanctions on Malicious Cyber-Enabled Activities","31 CFR Part 510: North Korea Sanctions Regulations (OFAC)",{},"published","2026-10-13T22:20:17.43295+00:00","2026-10-13T22:20:17.411+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcyberscoop.com\u002Fdoj-north-korea-remote-work-laptop-farms\u002F","doj-charges-14-over-a-sprawling-north-korean-remote-work-scheme-cce47c","DOJ charges 14 over a sprawling North Korean remote work scheme",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]