FBI Warns North Korean IT Workers Are Expanding Use of Facilitators
Summary
The FBI says North Korean IT workers are using more facilitators, stolen identities, and threats to infiltrate companies. It recommends layered identity checks and gives individuals and businesses steps to spot and report the activity.
Key points
- The FBI says North Korean IT workers increasingly pay Americans and foreign freelancers to help secure jobs, conduct interviews, host work devices, or provide identities and accounts.
- Facilitators may keep employer-provided devices online from residences while workers access them remotely; the FBI says operators are spreading laptops across more, smaller laptop farms.
- The advisory describes stolen identities, forged verification documents, and the use of compromised personal and professional accounts to apply for jobs.
- The FBI reports threats against former managers and companies, including demands for payments and threats to expose sensitive corporate data.
- For employers, the FBI recommends layered identity verification and access controls throughout employment, assessing multiple behavioral signals together rather than relying on one indicator or ban lists.
- The FBI advises coordination among IT, HR, security, and management, while calibrating detections to avoid harming legitimate employees or applicants.
- People approached to assist should refuse requests for personal information or account access; the FBI recommends reporting suspected activity to a local field office and filing an IC3 complaint at www[.]ic3[.]gov.
Article Details
- Defense Focus
- Detect and disrupt North Korean IT worker employment fraud through layered identity verification, access controls, and correlated behavioral signals throughout the employment lifecycle.
- Detection Methods
- Aggregate multiple applicant and employee behaviors rather than relying on a single indicator or name-based ban list.
- Review use of remote desktop software, external KVM-over-IP hardware, and separate laptops accessing employer-provided devices.
- Look for downloads or use of applications unrelated to an employee’s job role.
- Correlate unusually frequent changes to bank accounts, addresses, social media accounts, and other identifiers.
- Use live identity verification and compare multiple identity documents; the FBI notes that E-Verify and U.S. passport requirements can raise friction.
- Combine insights from IT, human resources, security, and management, with substantive review and ongoing calibration to reduce false positives.
- Data Sources
- Applicant and employment identity-verification records
- Corporate device and network activity, including remote-access connections and application downloads
- Employment-related device connectivity and known device locations
- Account and identifier histories, including addresses, bank accounts, social media, and professional networking accounts
- Internal observations from IT, human resources, security, and management
- Platforms
- E-Verify
- Defensive Actions
- Apply layered access controls and continuous identity verification throughout employment.
- Require live verification and multiple forms of identification; consider U.S. passport requirements where appropriate.
- Review aggregated behavioral signals before escalating or taking action, and continuously refine detection to limit harm to legitimate employees and applicants.
- Do not rely solely on ban lists or filtering names associated with IT worker activity.
- Coordinate detection across IT, human resources, security, and management.
- Report suspected activity to a local FBI Field Office and file an IC3 complaint.
MITRE ATT&CK
T1078 · Valid AccountsThe article describes IT workers using stolen identities and facilitators’ identities or accounts to obtain employment and access company devices.T1219 · Remote Access ToolsThe article says North Korean IT workers use remote desktop software, including AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, and Splashtop Streamer, to connect to employment-related devices.
Products
AnyDeskExamples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.Chrome Remote DesktopExamples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.E-VerifyUsing E-Verify, requiring a U.S. passport, multiple forms of identification, or live verification can raise friction for ITWs.GL.iNetITWs use external hardware such as TinyPilot, PiKVM, GL.iNet, and other Keyboard Video Mouse (KVM) over IP devices to control laptops.HomebrewITWs abuse open-source software, such as "OBS Studio" with a "VDO.Ninja" plugin (formerly "OBS.Ninja") to establish remote connections, and Homebrew for package management.OBS StudioITWs abuse open-source software, such as "OBS Studio" with a "VDO.Ninja" plugin (formerly "OBS.Ninja") to establish remote connections, and Homebrew for package management.PiKVMITWs use external hardware such as TinyPilot, PiKVM, GL.iNet, and other Keyboard Video Mouse (KVM) over IP devices to control laptops.RustDeskExamples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.SplashtopExamples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.TeamViewerExamples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.TinyPilotITWs use external hardware such as TinyPilot, PiKVM, GL.iNet, and other Keyboard Video Mouse (KVM) over IP devices to control laptops.VDO.NinjaITWs abuse open-source software, such as "OBS Studio" with a "VDO.Ninja" plugin (formerly "OBS.Ninja") to establish remote connections, and Homebrew for package management.
Countries
IndiaITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries.NigeriaITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries.North KoreaThe Democratic People's Republic of Korea (North Korea) continues to improve its tactics to infiltrate western companies with thousands of state-controlled remote "IT Workers" (ITWs) while avoiding detection.PakistanITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries.United StatesKorean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress.