Thousands of North Korean operatives are posing as information technology workers to secure remote positions at U.S. companies, ultimately funneling millions of dollars back to the regime in Pyongyang. These workers are using a combination of stolen American identities, U.S.-based "laptop farms," and artificial intelligence to craft résumés and assist with job interviews. According to the U.S. Treasury Department, this state-directed workforce generated nearly $800 million for North Korea in 2024 alone, aiding the heavily sanctioned nation in funding its weapons programs.
"The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," stated Treasury Secretary Scott Bessent.
The infiltration goes beyond financial gain. Once hired, these operatives acquire legitimate credentials and trusted access to corporate networks, potentially enabling theft, espionage, extortion, and more sophisticated cyber operations. Michael "Barni" Barnhart, a cybersecurity threat hunter specializing in North Korean IT operations, told Fox News that evidence of these workers applying to, working for, or targeting 18 out of 20 sampled Fortune 500 companies indicates their pervasive presence. Barnhart, formerly with Mandiant and now at DTEX, tracks nation-state insider threats, including this large-scale operation.
North Korea begins cultivating its cyber workforce at a young age, identifying children with aptitudes for math, science, and technology for specialized training. The most talented are directed toward elite hacking units, while others form the overseas IT workforce. The scheme is continually evolving; as American companies improve at detecting suspicious overseas applicants, North Korean operatives are increasingly recruiting individuals within the U.S. and other countries to act as intermediaries for job interviews and to host company laptops. They are also leveraging generative AI and interview-assistance tools to help answer questions during live interviews and to create deepfakes to bypass more sophisticated identity verification methods.
These intermediaries, often recruited through social media and online forums, may initially be offered small sums to host laptops or lend their identities. The requests can escalate over time, creating a network of facilitators who obscure the North Korean worker's true location. Companies mailing laptops to new hires often send them to addresses in the U.S. to avoid immediate red flags, with "laptop farms" managed by Americans receiving and hosting dozens of computers for various companies. The Justice Department has prosecuted an increasing number of facilitators for their roles in these schemes, with some knowingly participating and others initially unaware of the full extent of the deception.
Recent cases highlight the scale of the operation. In 2025, Arizona resident Christina Chapman was sentenced to over eight years in prison for her role in helping North Korean IT workers secure jobs at more than 300 U.S. companies, including Fortune 500 corporations. Chapman operated a laptop farm, receiving and storing company laptops at her home and deceiving employers about the remote workers' locations. The North Korean workers are also reportedly using the identities of ordinary Americans. The Wall Street Journal reported on Michael Brown, whose identity was used by North Korea to obtain jobs at at least two companies.
Beyond revenue generation, the operatives pose a significant security risk. Barnhart has observed evidence of these workers gaining access to organizations with strategic intelligence value, including critical infrastructure, defense contractors, and sensitive research and development sectors. This access can allow them to steal information or create openings for more sophisticated North Korean cyber actors.
The remote work revolution, accelerated by the COVID-19 pandemic, significantly amplified this threat, providing North Korean operatives the scale needed to infiltrate companies without physical presence. This operation serves as a crucial bypass for international sanctions, generating a steady stream of revenue that supports the North Korean government and its weapons programs.
The money generated through these IT workers and other illicit activities is used by North Korea to support its weapons of mass destruction and ballistic missile programs. This revenue stream is particularly significant given the extensive international sanctions against the regime. Furthermore, North Korea's increasing military relationship with Russia, including providing ballistic missiles and troops for the conflict in Ukraine, is seen as being indirectly fueled by this revenue. Ukrainian President Volodymyr Zelenskyy has stated that Russia's war effort is dependent on North Korean support, which in turn allows Pyongyang to test and improve its weapons systems under real battlefield conditions.
Barnhart emphasizes that companies cannot solely rely on law enforcement due to the operation's vast scale and the operatives' elusiveness. He advises companies to enhance remote hiring and identity verification procedures, including conducting identity checks alongside traditional background checks to ensure the person interviewed is who they claim to be. "We have to change," Barnhart said. "We can't just rely on law enforcement. They're only gonna go so far. We have to rely on our own policies and our own verifications in being able to stop them."