FBI PSA: North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment

The Democratic People's Republic of Korea (North Korea) continues to improve its tactics to infiltrate western companies with thousands of state-controlled remote "IT Workers" (ITWs) while avoiding detection. ITWs are increasingly using facilitators to counter improved private sector detections and law enforcement actions. The FBI has observed North Korean ITWs use stolen identities, extort victims, and use threats of physical violence to demand payments. ITWs fund North Korea's government, including its nuclear weapons and other military programs, and pose a significant national security and intellectual property theft insider threat.

The FBI is updating its previous guidance to the public and private sector on techniques and recommendations to identify and avoid this threat. This includes tips to protect yourself and your business, as well as a larger description of how the threat has recently evolved.

The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress. ITWs are paying Americans for an expanding range of services to hide their own involvement in the scheme, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences. These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny.

U.S. companies should recognize the scale, persistence, and rapid evolution of the North Korean ITW threat means ITWs cannot be identified reliably with a single indicator. Mirroring cybersecurity concepts, detection requires an "identity in depth" approach for effective defense, consisting of multiple layered access controls and detections throughout the employment lifecycle to find, interdict, and remove ITWs regardless of North Korean tactical innovations.

View the detailed PSA below.