{"id":14569,"date":"2025-08-06T07:04:07","date_gmt":"2025-08-06T07:04:07","guid":{"rendered":"https:\/\/newestek.com\/?p=14569"},"modified":"2025-08-06T07:04:07","modified_gmt":"2025-08-06T07:04:07","slug":"how-not-to-hire-a-north-korean-it-spy","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14569","title":{"rendered":"How not to hire a North Korean IT spy"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

CISOs looking for new IT hires already struggle with talent market shortages<\/a> and bridging cybersecurity skills gaps<\/a>. But now they face a growing challenge from an unexpected source: sanctions-busting North Korean software developers<\/a> posing as potential hires.<\/p>\n

North Korea is actively infiltrating Western companies<\/a> using skilled IT workers who use fake identities to pose as remote workers with foreign companies, typically but not exclusively in the US.<\/p>\n

These North Korean IT workers<\/a> use fake identities<\/a>, often stolen from real US citizens, to apply for freelance contracts or remote positions.<\/p>\n

Estimates of the extent of the crime are hard to come by, but a United Nations Panel of Experts report last year estimated 3,000 North Korean IT workers abroad \u2014 often in either China or Southeast Asia \u2014 and another 1,000 more operating inside North Korea were generating between $250 million and $600 million per year.<\/p>\n

The schemes \u2014 effectively a state-sanctioned crime syndicate \u2014 are part of illicit revenue generation efforts by the North Korean regime, which faces financial sanctions<\/a> over its nuclear weapons program, as well as a component of the country\u2019s cyberespionage activities<\/a>.<\/p>\n

Recent examples of the trend have included the use of deepfake technologies, extortion scams, and increased expansion into Europe. In 2025, DPRK agents expanded their focus to include cybersecurity roles, and they increased the use of female personas, the Sophos Counter Threat Unit Research Team reports<\/a>.<\/p>\n

<\/a>Multimillion-dollar fake worker cell busted<\/h2>\n

The US Treasury department first warned about the tactic in 2022<\/a>. Thousands of highly skilled IT workers from North Korea are taking advantage of the demand for software developers to obtain freelance contracts from clients around the world, including in North America, Europe, and East Asia.<\/p>\n

\u201cAlthough DPRK [North Korean] IT workers normally engage in IT work distinct from malicious cyber activity, they have used the privileged access gained as contractors to enable the DPRK\u2019s malicious cyber intrusions,\u201d the Treasury department warned.<\/p>\n

\u201cThese IT workers often rely on their overseas contacts to obtain freelance jobs for them and to interface more directly with customers,\u201d it adds.<\/p>\n

North Korean IT workers present themselves as South Korean, Chinese, Japanese, or Eastern European, and as US-based teleworkers.<\/p>\n

DPRK freelancers are using front companies \u2014 posing as software development or tech consulting firms \u2014 in China, Russia, Southeast Asia, and Africa to mask identities and secure jobs in Western companies, according to research by SentinelOne<\/a>.<\/p>\n

In the years since the Treasury department\u2019s first warning, examples of the ruse in action are increasingly emerging, not least through ongoing prosecutions.<\/p>\n

For example, Christina Chapman, of Litchfield Park, Ariz., was jailed in July 2025 following her conviction for fraud, identity theft, and money laundering charges<\/a> for orchestrating an elaborate scheme that enabled North Korean IT workers to pose as US citizens and residents using stolen identities to obtain jobs at more than 300 US companies and two international firms. The conspiracy generated more than $17 million in illicit revenue over the course of three years between October 2020 and October 2023.<\/p>\n

US payment platforms and online job site accounts were abused to secure jobs at a wide range of companies, including a major TV network, a car manufacturer, a Silicon Valley technology firm, and an aerospace company. \u201cSome of these companies were purposely targeted by a group of DPRK IT workers,\u201d according to US prosecutors<\/a>, who add that two US government agencies were \u201cunsuccessfully targeted.\u201d<\/p>\n

Chapman ran a \u201claptop farm,\u201d hosting the overseas IT workers\u2019 computers inside her home so it appeared that the computers were located in the US. The 50-year-old received and forged payroll checks, and she laundered direct debit payments for salaries through bank accounts under her control.<\/p>\n

Much of the $17.1 million received from the work was falsely reported to tax authorities using the stolen identities of 68 US citizens.<\/p>\n

The case is only the most high profile of several US prosecutions (examples here<\/a> and here<\/a>) involving North Korean IT worker scams.<\/p>\n

<\/a>Tradecraft<\/h2>\n

Insider risk management firm DTEX reports that the techniques leveraged by DPRK agents to evade detection have evolved<\/a>, reducing reliance on traditional \u201claptop farms,\u201d to include tactics such as:<\/p>\n