Dozens of U.S. companies have unknowingly hired North Korean IT workers who used stolen identities to get remote jobs and funnel their salaries back to Pyongyang, the Justice Department says, per TechCrunch. The disclosure is the clearest official confirmation yet that a scheme the FBI has warned about for years has moved from isolated cases to something closer to an industry.
The playbook is well documented. Operatives — tracked by researchers under names such as "Famous Chollima" and "Jasper Sleet" — buy or rent the identities of real people, pass remote interviews with the help of AI-assisted answers and outside "facilitators" who coach them, then take contract or full-time developer roles inside Western firms. Because they are paid as ordinary employees, their wages become a revenue stream for a state under heavy sanctions; U.S. officials have said the earnings help fund North Korea's weapons programs. Prosecutors have also described "laptop farms": rooms of machines in the U.S. that relay a worker's home-computer traffic so it appears to originate domestically.
Earlier cases exposed the depth of the problem. In 2024 the Justice Department unsealed charges against 14 North Korean nationals accused of operating as remote IT workers, and in a separate case a U.S. woman pleaded guilty to running a laptop farm, hosting a worker who was photographed at his company's own holiday party. Fines and seizures followed, but the model has proved resilient because it attacks a genuine weakness: Western tech's appetite for cheap, competent remote developers, and its thin identity checks at hiring.
For engineering and security leaders, the message is concrete. Remote-hire verification is now a security control, not a formality: verify identity documents against government sources, require in-person or supervised onboarding, monitor for device-use anomalies and proxy traffic, and treat unexplained access to code repositories and CI pipelines as a supply-chain risk.
The Justice Department has not said which companies were affected. That silence is itself a warning — in most of these cases, employers learn who was on their payroll only after a knock at the door.
