FBI updates guidance on North Korean IT worker threat as facilitator use expands
The FBI's Internet Crime Complaint Center has refreshed its public and private sector guidance on North Korean remote IT workers who infiltrate western companies using stolen identities. The alert documents a shift toward paid facilitators, subcontracting to third-party foreign nationals, extortion and threats of physical violence, and urges firms to adopt a layered "identity in depth" detection approach rather than relying on single indicators.
- North Korean ITWs collect salaries, steal data and extort victims under government direction, with the North Korean government receiving an estimated 85-90% of the revenue the actors generate.
- ITWs pay facilitators to appear on camera, sit interviews, verify fraudulent identities, ship packages, complete urinalysis or fingerprint submissions, and host employment devices in "laptop farms".
- The FBI has observed ITWs make death threats against former managers and families, and threaten to leak corporate data unless paid large lump sums.
- ITWs target positions requiring U.S. government security clearances, cleared defense contractors, and active-duty military members asked to host laptops.
- The FBI urges an "identity in depth" approach of layered access controls and continuous verification, warning that sole reliance on ban lists is unreliable and can block identity-theft victims.