North Korean IT workers in remote jobs: the documented cases

North Korean IT workers have obtained remote jobs at hundreds of US companies under stolen or borrowed identities, according to US Justice Department cases from 2025. This article sets out what the court cases, FBI notices and company reports document, and the hiring steps the FBI recommends.

What the court cases show

On June 30, 2025 the Justice Department announced coordinated actions against North Korean remote IT worker schemes: two indictments, an arrest, searches of 29 known or suspected "laptop farms" across 16 states, and the seizure of 29 financial accounts and 21 fraudulent websites. In one scheme, which ran from about 2021 until October 2024, the defendants and their co-conspirators compromised the identities of more than 80 US persons to obtain remote jobs at more than 100 US companies, many of them in the Fortune 500. The victim companies' losses came to at least $3 million. The department says some workers stole export-controlled US military technology, and in a separate scheme workers hired under false identities stole virtual currency worth more than $900,000.

On July 24, 2025 an Arizona woman, Christina Chapman, was sentenced to 102 months in prison. The department called the case one of the largest of its kind that it had charged. It involved 68 stolen identities, 309 US businesses and two international ones, and more than $17 million in revenue. The companies included a top-five television network, a Silicon Valley technology company, an aerospace manufacturer and an American car maker.

On December 4, 2025 a Maryland man was sentenced to 15 months. He had taken jobs at no fewer than 13 US companies between 2021 and 2024 and let a man in Shenyang, China do the work with his credentials. Prosecutors say that man is likely a North Korean national. One of the jobs was on a Federal Aviation Administration contract.

The department's June release cites a May 2022 US government advisory for the money involved. A single worker has been known to earn up to $300,000 a year, and together the workers generate hundreds of millions of dollars a year for entities that include the North Korean Ministry of Defense.

How the schemes get past hiring

The workers apply under the identities of real people, so ordinary checks pass. The security company KnowBe4 reported in July 2024 that it had hired one after four video interviews and a background check that came back clear, because the identity was valid and stolen. The application photo had been altered with AI from a stock photograph. The laptop KnowBe4 shipped began loading malware once it was received. Its security team detected suspicious activity at 9:55pm EST on July 15, 2024 and contained the device at about 10:20pm, and the company says no data was lost.

People inside the United States make the workers look local. Chapman received company laptops at her home and hosted them there, so employers believed the work was done in the US. More than 90 laptops were seized from her home, and she had shipped 49 devices overseas. In the June 2025 case, the indictment says facilitators connected the laptops to keyboard-video-mouse switches so that workers abroad could operate them. They also set up shell companies with websites and bank accounts, so the workers appeared to belong to legitimate US businesses.

The interview is part of the deception. An FBI notice of January 2025 says North Korean IT workers have used AI and face-swapping technology during video job interviews. An earlier notice from October 2023, issued with South Korean agencies, lists warning signs for interviewers: a candidate who is unwilling or unable to appear on camera, inconsistencies in time, location or appearance on camera, and signs of cheating such as excessive pausing, eye movements that suggest reading, and incorrect answers that sound plausible. The last group overlaps with the signs a candidate is using AI.

What happens after the hire

Wages are one part of the harm. The FBI's January 2025 notice says that workers discovered on company networks have held stolen data and code hostage until the company paid a ransom, and in some instances have published a company's code. They have also copied company code repositories to their own profiles and personal cloud accounts.

Google's Threat Intelligence Group reported in April 2025 that extortion attempts had grown in volume since late October 2024 and were aimed at larger organizations. The same report describes more activity in Europe. In late 2024 one worker operated at least 12 personas across Europe and the United States, other personas sought jobs in Germany and Portugal, and a corporate laptop meant for use in New York was found operating in London.

What hiring teams can do

The FBI's January 2025 notice has a list for remote hiring:

• Verify identity during interviewing, during onboarding and throughout the employment of any remote worker.
• Search HR systems for other applicants with the same résumé content or contact details.
• Review each applicant's phone number and email address, because workers have reused them on résumés under different names.
• Check that third-party staffing firms have sound hiring practices, and audit them.
• Ask "soft" interview questions about specific details of the applicant's location or education.
• Complete as much of hiring and onboarding as possible in person.

The 2023 notice adds steps for the video call and for equipment. Have the candidate hold an identity document up to the camera, and keep records of every interaction, including recordings of video interviews. Require a signature on delivery, and send devices only to the designated work location.

At Chapman's sentencing, US Attorney Jeanine Ferris Pirro addressed employers directly: "Corporations failing to verify virtual employees pose a security risk for all."

The FBI asks companies that suspect they have been approached by a North Korean IT worker to report it to the Internet Crime Complaint Center. A step-by-step version of the checks is in how to verify a remote candidate's identity, and the wider problem is covered in deepfake candidates and fake identities in remote hiring.

Where the interview fits

The FBI's advice begins at the interview: see the candidate on camera, see the document and keep a record. SecureInterview is a video interview in the browser, and on Pro the host can record a meeting to their own device while everyone in it sees "Recording". See how it works.