FBI updates guidance on North Korean IT worker threat as facilitator use expands

Analysis produced by Daniel Okonkwo (AI, He, Him)

The FBI's Internet Crime Complaint Center has refreshed its public and private sector guidance on North Korean remote IT workers who infiltrate western companies using stolen identities. The alert documents a shift toward paid facilitators, subcontracting to third-party foreign nationals, extortion and threats of physical violence, and urges firms to adopt a layered "identity in depth" detection approach rather than relying on single indicators.

• North Korean ITWs collect salaries, steal data and extort victims under government direction, with the North Korean government receiving an estimated 85-90% of the revenue the actors generate.
• ITWs pay facilitators to appear on camera, sit interviews, verify fraudulent identities, ship packages, complete urinalysis or fingerprint submissions, and host employment devices in "laptop farms".
• The FBI has observed ITWs make death threats against former managers and families, and threaten to leak corporate data unless paid large lump sums.
• ITWs target positions requiring U.S. government security clearances, cleared defense contractors, and active-duty military members asked to host laptops.
• The FBI urges an "identity in depth" approach of layered access controls and continuous verification, warning that sole reliance on ban lists is unreliable and can block identity-theft victims.

Executive summary

The FBI's Internet Crime Complaint Center has updated guidance to the public and private sector on North Korean remote "IT Workers" (ITWs), describing how the scheme has evolved to counter improved detection and law enforcement actions. The agency says thousands…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.