Kim Yeojin โ The FBI has issued a public safety alert warning that North Korean IT workers are increasingly exploiting economic vulnerabilities in the US to infiltrate companies through sophisticated North Korean remote IT scam operations. These cyber actors use proxy individuals, identity theft, and fake freelance arrangements to secure remote tech jobs, generating revenue to fund North Korea’s military and weapons programs.
How the Laptop Farm and Proxy Scam Operates
According to the FBI, North Korean IT operatives post fake freelance job listings or approach financially struggling individuals with offers for easy remote work tasks. Unwitting proxies are often completely unaware they are assisting illegal foreign schemes. Their roles typically involve attending video interviews on behalf of the real applicants, renting out social media accounts, and verifying fake identities.
A primary tactic involves operating ‘laptop farms’ within the US. Proxies set up company-issued work laptops in their homes and connect them to the internet, allowing overseas North Korean workers to remotely log in and work as if they were physically present in the United States. In some cases, low-cost freelancers in countries like Pakistan, India, and Nigeria are hired as subcontractors to do the actual coding while the North Koreans pocket the majority of the wages.
Extortion Threats and Broadening Infiltration Targets
The criminal enterprise has escalated beyond simple job fraud into severe extortion and cyber threats. Fired North Korean IT workers have been documented launching death threats against former managers and their families, as well as threatening to leak sensitive corporate data and proprietary source code unless paid exorbitant ransoms.
Targeting has also expanded beyond standard corporations into defense contractors and government-cleared positions. Investigators have even detected attempts to approach active-duty US service members to receive and store corporate work laptops on military bases. FBI officials emphasize that these rings operate in coordinated teams led by experienced managers who report directly to North Korean state authorities, urging the public to report suspicious job offers immediately.
