North Korean IT workers hit 70+ US firms: verify remote hires
DOJ says North Korean IT workers got jobs at 70+ US companies via Texas laptop farms. The FBI's checklist shows how to verify remote hires and contractors.
The remote developer you hired last spring may not be the person on the video call. On October 13 the Justice Department announced coordinated actions against North Korean IT workers who got hired at more than 70 US companies with stolen identities. The victims were not only defense contractors. They included retail, health care, communications and manufacturing firms. If you hire remote developers or contractors, this is your problem too.
What actually happened
Between September 21 and 25, agents searched more than 40 Texas homes known or suspected to be "laptop farms." These are houses where a US facilitator keeps company-issued laptops, installs remote-access software, and lets workers overseas log in as if they were in the US. The DOJ says agents seized about 187 laptops and KVM devices.
An indictment in the Northern District of Ohio charges wire fraud, money laundering and identity theft. Two US nationals were arrested, and ten China-based individuals are charged. Per the DOJ, the scheme ran from 2019 to around July 2025 and made approximately $3 million for the workers. Victims were in Ohio, 16 other states and the District of Columbia. TechCrunch reports that CrowdStrike helped the FBI with the investigation.
On the same day, the FBI published a public service announcement that says "thousands" of these workers are inside Western companies. It also says some of them now subcontract the work to freelancers in South Asia and West Africa. So the person who writes your code can be two steps away from the person you hired.
Why remote hire verification matters for your business
Small teams are the easiest target. There is no security team, HR is one person, and a contractor who ships code on time does not get questions. These workers often do the work. The DOJ and FBI say the danger comes after: stolen data, then extortion.
The FBI's indicators are specific, and you can check most of them this week:
- Remote-access tools on a work device that do not need them: AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop.
- KVM-over-IP hardware such as PiKVM, TinyPilot or GL.iNet devices.
- Software unrelated to the job, for example OBS Studio with the VDO.Ninja plugin.
- Frequent changes to bank accounts, addresses or payroll details.
The FBI says no single sign is proof. Look for several signs together, and do not use name-based ban lists, because they hurt real identity-theft victims. For new hires, the FBI recommends E-Verify, more than one form of ID, and live identity verification. Our own rule is simple: a short live video call before access, and again after the first payroll change.
Key takeaways
- DOJ says North Korean IT workers got hired at 70+ US companies, including retail and health care firms
- Agents searched 40+ Texas laptop farms and seized about 187 laptops and KVM devices
- The FBI says some workers now subcontract jobs to freelancers, so the coder may not be the hire
- Check work devices for unneeded remote-access tools and KVM-over-IP hardware
- Use layered checks: E-Verify, multiple IDs, live verification, and review payroll changes
We build access you can audit. Least-privilege accounts, device checks and logs that show who touched what, so one bad contractor is a revoked key, not a breach. Talk to us about your setup.
Sources: U.S. Department of Justice, FBI IC3 PSA, TechCrunch.
- #north-korea
- #remote-hiring
- #insider-threat
- #identity-verification
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Windows Update certificates expire in 2027: audit your PCs
Windows Update certificates expire May 17 and June 19, 2027. Unsupported or unpatched PCs lose Windows Update for good. The patch levels each version needs.
Read itOne Contractor PC Exposed 8.7M Daiichi Kosho Records
Malware on a single contractor laptop exposed 8.7M karaoke customer and staff records. The vendor data breach lesson: limit what your contractors hold.
Read it