North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment

The Democratic People's Republic of Korea (North Korea) continues to improve its tactics to infiltrate western companies with thousands of state-controlled remote "IT Workers" (ITWs) while avoiding detection. ITWs are increasingly using facilitators to counter improved private sector detections and law enforcement actions. The FBI has observed North Korean ITWs use stolen identities, extort victims, and use threats of physical violence to demand payments. ITWs fund North Korea's government, including its nuclear weapons and other military programs, and pose a significant national security and intellectual property theft insider threat.

The FBI is updating its previous guidance to the public and private sector on techniques and recommendations to identify and avoid this threat. This includes tips to protect yourself and your business, as well as a larger description of how the threat has recently evolved.

The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress. ITWs are paying Americans for an expanding range of services to hide their own involvement in the scheme, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences. These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny.