FBI disrupts Pyongyang revenue stream: North Koreans in US tech jobs
Dustin Volz
asserted
FBI → disrupt → jobs
The FBI in September disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programmes, US officials said Oct 13.
asserted
officials → disrupt → programmes
The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by the US authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.
asserted
Korea → include → years
The Justice Department separately unsealed indictments in Ohio on Oct 13 against two US nationals and 10 China-based North Koreans accused of committing identity theft to earn pay cheques from unwitting US companies that hired them.
asserted
that → unseal → them
Prosecutors said that scheme bilked 70 companies out of more than US$3 million (S$3.84 million) and ran from 2019 to 2025.
asserted
scheme → say → 2025
The identities of two additional defendants remained under seal.
asserted
identities → remain → seal
The moves were the latest by the United States in an intensifying campaign to try to cut off a stealthy and evolving digital threat from North Korea whose scale is not entirely clear but likely vast.
asserted
scale → intensify → Korea
US intelligence officials in the Biden and second Trump administrations have said the IT worker scams are a primary method of funding Pyongyang’s weapons programme, alongside thefts of cryptocurrency.
asserted
scams → say → cryptocurrency
North Korea is deploying “thousands of state-controlled IT workers to infiltrate companies in the United States and allied countries”, Brett Leatherman, the head of the FBI’s cyber division, said in an interview.
asserted
Leatherman → deploy → interview
“Every one of these jobs is funding a stream for a nuclear and ballistic missiles programme obtained with the stolen identity of an American and the trust of an American employer.
asserted
one → fund → employer
The bureau worked closely with the US-based cybersecurity firm CrowdStrike to identify and disrupt the network, Leatherman said.
asserted
Leatherman → work → network
He added that the coordinated actions were an early example of the FBI’s new cyber strategy, which was unveiled in September and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity.
asserted
that → add → activity
The strategy is part of a broader effort across the Trump administration to work more closely with US companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.
asserted
strategy → work → experts
US officials and cybersecurity analysts have said the North Korean IT worker scheme is among the most serious ongoing digital threats facing businesses today and that it remains underappreciated as a risk.
Adam Meyers, who oversees counteradversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity”.
asserted
schemes → say → prevalence
It is difficult to know how widespread laptop farms are in the United States, Meyers said, but noted that CrowdStrike identified an average of two new cases per day throughout September – which is likely only the tip of the iceberg.
asserted
which → know → iceberg
For more than two years, US intelligence officials and cybersecurity researchers have warned that North Korea has been using stolen American identities – often acquired from compromised private information, like Social Security numbers, on the dark web – and artificial intelligence tools to get hired for remote IT jobs at companies across the United States, Europe and elsewhere.
asserted
Korea → warn → States
Experts have said companies ranging from small start-ups to Fortune 500 firms have been victimised.
asserted
companies → say → firms
A crucial aspect of the fraud campaign is support from people in the United States who are recruited by North Korea to help bypass corporate security measures that detect fraudulent hires, according to investigators.
uncertain
that → recruit → investigators
Facilitators help enable the fraud by receiving and setting up work laptops at addresses that appear like legitimate residences to corporate human resources teams.
asserted
that → help → teams
North Korean operators then use software to remotely tunnel into those laptops and work on them, posing as Americans to the companies that hired them.
asserted
that → use → them
The appeal for facilitators is simple: Jobs that look like easy cash and, at least at first, might not require much of them.
uncertain
that → look → them
“They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Meyers said.
asserted
Meyers → get → point
Leatherman said that the Texas sweep did not include any arrests of facilitators but that the authorities warned them they could face criminal penalties should they continue to assist with remote fraud.
uncertain
they → say → fraud
The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges, he said.
asserted
he → stem → charges
Leatherman said the laptop farms often operate like a “mini data centre” for the North Koreans, where one facilitator hosts dozens or even hundreds of laptops used to fill scores of jobs.
asserted
facilitator → say → jobs
A woman in Arizona sentenced in 2025 to more than eight years in prison was accused of hosting dozens of laptops at her home to help North Koreans connect to more than 300 US companies.
asserted
Koreans → sentence → companies
The tactics of North Korea’s IT worker army have steadily evolved to evade detection.
asserted
tactics → evolve → detection
That includes increased reliance on artificial intelligence to create fake resumes, videos and photos, and to navigate virtual job interviews, officials said.
asserted
officials → include → interviews
The fraudsters are also relying more on subcontractors in places like Pakistan and Nigeria to further obscure North Korean involvement, Leatherman said.
asserted
Leatherman → rely → involvement
In an advisory released on Oct 13, the FBI said the North Koreans were paying Americans and other Western accomplices to “perform a growing variety of identity and location obfuscation tasks” that included appearing on camera, participating in job interviews or meetings, verifying fraudulent identities, shipping packages, and even completing urinalysis tests or fingerprint submissions.
asserted
that → release → tests
The Aporia
