North Korea's Fake IT Workers Turn Remote Jobs Into Funding for Its Weapons Programs

Stolen identities, real salaries and a global operation

More than 80 Americans have had their identities stolen for use in North Korea's remote IT worker schemes, according to the U.S. Department of Justice. Hundreds of companies, from technology startups to defense contractors, have unknowingly employed North Korean operatives. The FBI has seized hundreds of computers, dozens of web domains and millions of dollars in cryptocurrency connected to these operations.

As of August 9, 2025, the operation stretches across the United States, Europe and other markets. Thousands of North Korean IT specialists use false identities and elaborate personal histories to obtain jobs with foreign companies. Their central task is to earn foreign currency for Kim Jong Un's government, evade international sanctions and direct money toward its nuclear and missile programs.

United Nations estimates put the annual income generated by North Korean IT workers at between $250 million and $600 million. Individual workers can earn as much as $300,000 a year, making technology jobs a valuable source of income for a government whose access to international trade and finance is restricted.

Remote employment gives the operation its opening. A company may pay someone it believes is a domestic software developer while the person doing the work is abroad, using a stolen identity and a computer controlled through an intermediary. The work can produce both genuine software and a hidden stream of money for North Korea.

Law enforcement actions, cybersecurity research and testimony from people who have left North Korea describe a network combining identity theft, cybercrime and espionage sponsored by the state. For employers, the exposure extends beyond salaries: an employee account can also open a route to confidential information and company systems.

How a false applicant becomes a remote employee

North Korean workers build convincing professional identities using stolen or fabricated personal details. LinkedIn profiles, GitHub accounts and forged academic records help make applicants appear to have the education, experience and work history that employers expect. GitHub, a service where developers share and manage code, can help an applicant present evidence of technical ability.

AI generated documents and edited images support these identities. Workers also use deepfake technology during video interviews. A deepfake is digitally altered audio or video that makes someone appear or sound like another person, allowing deception to extend beyond a written application.

Many operatives work outside North Korea, including in China, Russia and Southeast Asia. Some operate from Africa or the Middle East. These locations offer less restricted internet access and make it easier to evade surveillance while applying for jobs elsewhere.

Virtual private networks, known as VPNs, and other tools help conceal their locations. A VPN routes an internet connection through another server, so the location visible to an employer can differ from the worker's actual location. Remote management software lets someone control a computer from far away.

Western accomplices complete the arrangement by receiving company laptops, setting up remote access and handling payroll. A laptop farm is a physical location containing dozens of computers that workers abroad can control. If those computers are in the United States or Europe, their connections can make the employees appear to be working locally and help them pass basic location checks.

The deception therefore involves both a person and a place. An employer sees an apparently credible applicant, sends equipment to a domestic address and receives work through a computer located where the employee is expected to be. The person operating it may be thousands of miles away.

Life inside the overseas teams

Jin-su, a North Korean defector identified by that name, described applying for remote jobs with hundreds of false identities and holding several positions at once. His account gives a view of the workers behind the profiles and the pressure to keep earning.

Jin-su said he earned up to $5,000 a month and sent 85% back to the government. At that monthly income, the share sent back would be $4,250, leaving $750 for him. He described accepting the deception as part of his circumstances.

We know it's like robbery, but we just accept it as our fate," he said. "It's still much better than when we were in North Korea.

Most North Korean IT workers abroad operate in teams under close supervision by government minders. They have greater access to Western media and more freedom than people at home, but escaping carries serious risks for both the workers and their families.

Few choose to defect despite those dangers and restrictions. The portion of their earnings that they retain can change their lives by North Korean standards. Jin-su's account shows how a worker can regard the arrangement as exploitative while still seeing it as better than life at home.

Why technology jobs are valuable to Pyongyang

International sanctions, particularly those aimed at North Korea's weapons programs, have severely restricted its economy. Traditional sources of foreign currency, including laborers working in Chinese factories and on Russian construction sites, are drying up. Remote technology work offers another route to money from abroad.

Skilled IT work can pay far more than manual labor overseas. The potential annual income of up to $300,000 also creates an incentive to maintain several identities and jobs. Employers in the United States, Europe, New Zealand and the United Arab Emirates can all be reached through the internet.

Remote jobs rarely require meetings in person. That reduces the occasions when an employer might notice that an applicant's identity, location or background is false. Once employed, a worker may also gain access to intellectual property, company secrets and sensitive defense information.

The estimated $250 million to $600 million in annual earnings moves through intermediaries, cryptocurrency transactions and shell companies. A shell company is a business structure used to hold or move money, sometimes with little visible business activity. By passing payments through several people, accounts and companies, the network makes the final destination harder for authorities to trace.

Salary income and stolen funds can follow these concealed routes back to North Korea. The combination of legitimate employment payments and hidden control makes the operation difficult to identify through payroll records alone.

AI tools and the challenge of checking applicants

Microsoft's Threat Intelligence team tracks these activities under the name Jasper Sleet. Its findings describe workers using AI to create false personas, modify images for employment documents and alter their voices during interviews.

Cybersecurity researchers have also uncovered detailed interview scripts and forged resumes. Some operatives pay people in Europe or the United States to rent out their identities, offering a share of earnings in return for access to genuine documents and bank accounts.

Facilitators help workers pass employment verification, receive equipment and establish remote access. VPNs, virtual private servers and remote management tools help conceal where the work is happening. A virtual private server is a rented computing environment that can provide another point through which an internet connection passes.

Rob Henley, a hiring manager at Ally Security, described the effort required to separate genuine applicants from false ones.

Initially it was like a game to some extent, like trying to figure out who was real and who was fake, but it got pretty annoying pretty quickly.

Henley began asking applicants to show daylight during video calls. That simple check often exposed candidates working in a different time zone from the one they claimed. It added a physical detail to an interview otherwise conducted entirely through a screen.

AI makes familiar warning signs harder to spot. An inconsistent resume, an altered photograph or weak English can be disguised or improved with digital tools. Employers therefore face a problem that extends across recruitment, identity documents, interview behavior and the computers used after hiring.

Europe becomes a growing target

North Korean operatives have shifted more attention toward Europe as U.S. employers and law enforcement become more vigilant. Google's Threat Intelligence Group and other cybersecurity specialists warn that European technology firms are prime targets, particularly where identity checks are less stringent and hiring moves quickly.

Companies with bring your own device policies, commonly called BYOD, face particular exposure. These policies allow employees to use their own computers rather than equipment supplied by the company. A worker can then appear to be an ordinary remote employee while using personal hardware to enter company systems.

Fast recruitment and flexible device rules can help a false applicant begin work before inconsistencies are discovered. The same remote access that makes legitimate employment convenient also allows operatives abroad to participate without appearing at an office.

Some workers steal information after gaining access. Others threaten to release sensitive data or demand payment in cryptocurrency when their employment ends. For a company, identifying and dismissing a false employee may therefore be followed by an extortion attempt.

AI generated identities and deepfakes add to this difficulty by concealing signs that previously helped hiring teams identify suspicious applicants. The move toward Europe shows how the operation adjusts its targets when scrutiny increases in another market.

The intermediaries who keep the network running

Western facilitators provide the local infrastructure that workers overseas cannot easily create themselves. Some are unwitting participants; others knowingly support the operation. Their roles can span recruitment, equipment, identity documents and payments.

• Receiving company laptops and configuring them for remote access.
• Opening bank accounts and shell companies to collect salaries.
• Supplying false passports, local telephone numbers and references.
• Coaching workers on cultural details and hiring practices.

Several Americans have been indicted for operating laptop farms or serving as financial intermediaries. In one case, a U.S. citizen was charged with running a laptop farm from his home, allowing North Korean workers to control dozens of computers and move their salaries through concealed financial arrangements.

Other people have been prosecuted for helping steal and transfer cryptocurrency. The Department of Justice has seized millions of dollars connected to these activities. The operation's scale and ability to adapt mean that facilitators remain active, with new recruits sought through social media and online forums.

A local address, bank account or telephone number can make a false identity look more credible. These services explain why the operation depends on more than skilled developers: it also needs people who can make employment and payment arrangements appear ordinary to companies and financial institutions.

When employee access becomes a security threat

Foreign currency is the central objective of the IT worker scheme, but access to an employer can support other activities. Workers may steal intellectual property and trade secrets, obtain sensitive defense contractor information, or access material subject to export controls. Export controls restrict the transfer of certain goods, technology and information across borders.

Operatives can also plant malicious software for later ransomware attacks or espionage. Ransomware is software used to lock or steal information and demand payment. Internal company information can be collected for North Korean hacking groups, including the Lazarus Group.

Documented cases include IT workers stealing cryptocurrency, extorting employers and helping larger cyberattacks. Lazarus alone is believed to have stolen more than $3 billion in cryptocurrency since 2007, including a record $1.5 billion theft in 2025. That single theft amounts to half of the $3 billion benchmark, illustrating the size of the 2025 attack.

The dates given for the cryptocurrency activity and the wider employment scheme provide a short timeline:

• Since 2007: Lazarus is believed to have stolen more than $3 billion in cryptocurrency.
• 2025: A record cryptocurrency theft attributed to the group reached $1.5 billion.
• August 9, 2025: North Korea's IT worker operation includes false identities, laptop farms and a growing focus on European employers.

The United Nations estimates that cyberattacks generate about half of North Korea's foreign currency income and account for 40% of the funding for its weapons of mass destruction programs. Remote IT employment forms part of the same broader effort to obtain money despite sanctions.

What employers can change

Companies face exposure at several stages, from the first application to the removal of an employee's access. The recommendations focus on checking identity more carefully, monitoring unusual activity and coordinating recruitment with computer security teams.

• Verify applicants' digital histories, check references and use video calls to confirm identity.
• Watch for suspicious internet addresses, shared telephone numbers and unexpected remote management software.
• Require security controls on devices, limit access from personal computers and separate sensitive systems from ordinary work environments.
• Train human resources and IT staff to recognize warning signs and share concerns about identity verification.
• When a suspected North Korean worker is identified, keep the response within a trusted group, examine connections to possible collaborators and preserve evidence for law enforcement.

Authorities also warn employers about unusually low bids for contract work, requests for cryptocurrency payments, applicants who avoid video interviews and inconsistent documents. Each can prompt a closer check before a company grants access or transfers money.

Separating sensitive systems limits what a worker can reach through a routine employee account. Preserving evidence helps investigators reconstruct how the person was hired, which equipment was used and where payments went. Checking for collaborators matters because several identities or accounts may belong to the same operation.

An international response to an adaptable operation

Governments in the United States, Japan, South Korea and Europe have issued warnings, tightened enforcement and prosecuted foreign enablers and domestic collaborators. Freelancer platforms and technology companies are being urged to strengthen identity checks and monitor suspicious activity.

North Korea's shift from overseas manual labor toward remote technology jobs, and from greater reliance on U.S. targets toward Europe, shows the continuing pressure on enforcement. Restrictions on one source of income are followed by efforts to find another.

An unnamed expert described the expected response to the crackdown in these terms:

North Korea's attempts to infiltrate Western companies for profit and espionage will continue. The crackdown will disrupt operations, but North Korea is expected to adapt.

For employers, the concrete task is to connect hiring checks with security controls throughout employment. For governments, the response includes tracing payments, identifying facilitators and disrupting the infrastructure that lets workers abroad appear to be local employees.

Key Points

• Thousands of North Korean IT workers use false identities to obtain remote jobs and earn foreign currency for the government.
• The United Nations estimates annual IT worker earnings of $250 million to $600 million.
• The Department of Justice says more than 80 Americans' identities were stolen for these schemes, with hundreds of companies unknowingly employing operatives.
• Laptop farms, Western intermediaries, AI tools and remote access software help conceal workers' identities and locations.
• Employee access can lead to stolen data, cryptocurrency theft, extortion and support for wider cyberattacks.
• Operatives are increasing their focus on Europe as scrutiny grows in the United States.
• Authorities urge stronger identity verification, closer monitoring, tighter device security and preservation of evidence when suspicious workers are found.