North Korean IT Workers Hit 70 US Firms: 6 Hiring Defenses

North Korean IT workers have landed jobs at no fewer than 70 US companies, and the Justice Department has just shown exactly how the scheme works.

On Tuesday, October 13, the DOJ announced raids on more than 40 “laptop farms” in Texas, its largest sweep of this kind. Authorities seized over 180 computers that US companies had shipped to newly hired remote staff. Those staff were not who they claimed to be. According to TechCrunch, the workers were North Korean operatives using stolen American identities.

How the Laptop Farm Scheme Works

The trick is simple, and that is what makes it dangerous. A North Korean worker applies for a remote IT job using a stolen identity, a polished LinkedIn profile and a realistic email address. Once hired, the company ships a laptop to the listed US address. A local facilitator, the “laptop farm” owner, receives it and connects it to the internet so the real worker can log in from abroad.

The DOJ says at least two American facilitators owned the Texas sites. Two people have been indicted and arrested. The workers also now subcontract entire jobs to foreign nationals, which adds yet another layer of obscurity.

The Scale Is Bigger Than One Raid

At least 70 US companies were infiltrated across Ohio, 16 other states and Washington, DC. Victims include healthcare, retail, communications, manufacturing and cyber support firms. The hackers are believed to have generated about $3 million in funds. The DOJ did not name the companies.

A separate FBI public service announcement goes further. It says “thousands” of state-controlled North Korean IT workers sit inside Western companies. Experts quoted in the coverage believe the real numbers of hacked firms and stolen money are far higher than anything reported so far. CrowdStrike, which helped the FBI, said North Korean actors were behind roughly half of documented hands-on-keyboard intrusions over the past year.

Defense 1: Verify Identity Beyond the Resume

Run live video interviews and ask candidates to show government ID on camera. Compare the face against the ID. Then verify the ID with a trusted identity-verification service rather than trusting a scanned PDF.

Be wary of candidates who refuse video, claim a broken camera or keep their background blurred. None of these alone proves anything. Together, they are a pattern worth escalating.

Defense 2: Treat Hardware Shipping as a Security Event

Shipping a laptop to a home address is a trust decision. Check that the address matches the verified identity. Flag addresses linked to multiple employees or to residential properties with unusual network activity.

Better still, use managed devices with remote lock and wipe, and require enrolment in mobile device management before first login. If the device appears online from an unexpected network, such as a remote-access tool, the system should alert you at once.

Defense 3: Watch for Remote-Access Tools

Laptop farms rely on software that lets someone else control the machine from another country. Block unapproved remote-desktop and KVM-over-IP tools on corporate endpoints. Monitor for them too, because attackers rename things.

Endpoint detection should flag sessions where keyboard timing, geolocation and VPN use do not line up with the employee’s stated location.

Defense 4: Apply Zero Trust to New Hires

A new employee should not get broad access on day one. Start with least privilege and expand it based on role, time and behavior. Segment source code, customer data and production systems.

Zero trust is not a product. It is a habit: verify continuously, grant narrowly, log everything. Remote hires make that habit essential.

Defense 5: Check Payroll and Payment Patterns

Red flags often show up in payroll before they show up in security tools. Look for bank accounts that do not match the employee’s name, requests to change payment details soon after hire, or payments routed through unusual intermediaries.

Finance and security teams rarely talk to each other. This scheme is a good reason to change that.

Defense 6: Train Your Recruiters and Managers

Your first line of defense is not a firewall, it is the person scheduling the interview. Teach recruiters the common signs: scripted answers, odd time zone excuses, reluctance to meet in person and resumes with vague employer history.

Managers should also notice behavior after hire. Working hours that mirror a different time zone, strange latency, or someone who never joins spontaneous calls are all worth a quiet check.

Why This Matters Beyond the US

The DOJ noted that North Korean workers target US and European employers. Pakistani software houses that hire remote contractors, or that outsource to foreign freelancers, face the same risk from the other direction. A fake contractor inside your delivery pipeline can leak a client’s code or credentials, and that damages trust you spent years building.

Key Takeaways

• Scale: At least 70 US companies were infiltrated, with over 40 laptop farms raided in Texas and 180+ computers seized.
• Method: Stolen identities, spoofed profiles and US-based facilitators who host company laptops.
• Verification: Use live video, ID checks and trusted identity-verification services.
• Technical controls: Managed devices, remote-tool blocking and least-privilege access.
• People and process: Train recruiters and connect HR, finance and security teams.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions. Talk to our experts.

When did your team last verify that every remote hire is who they say they are?