North Korean Remote IT Worker Schemes & Laptop Farms

North Korean remote IT worker schemes are covert operations where DPRK nationals, often stationed in third countries or inside North Korea, use stolen or borrowed identities to secure remote programming and IT jobs with Western companies, with the FBI and cybersecurity firms warning that these workers may be linked to state-sponsored hacking. Laptop farms are the technical infrastructure for this deception: a location, often a residential apartment or office in a country like China or Russia, where multiple remote workers operate a bank of computers, sometimes with remote-desktop software that lets a North Korean operator control a machine that appears to be in the worker’s claimed home country. These schemes are a serious and growing threat to corporate security, and understanding how they operate is the first step in defending against them.

Background: How the Scheme Started

The scheme gained public attention around 2020 when U.S. authorities indicted three North Korean hackers for posing as remote IT workers to steal data and extort money. The United Nations and cybersecurity firms have since documented a broader pattern: North Korea, facing international sanctions and a need for foreign currency, has dispatched workers to countries like China, Russia, and Southeast Asia, where they apply for remote jobs with U.S. and European tech companies. The workers often use fake or stolen identities of American citizens, complete online interviews, and pass background checks by having a U.S.-based accomplice (sometimes a paid “mule�) handle video calls or receive equipment.

The scale is significant: the FBI has estimated that thousands of North Korean IT workers may be deployed globally, and they have been linked to revenue generation for the DPRK government, which uses the funds for weapons programs. The scheme is not just about stealing source code; it is a sanctioned state operation to infiltrate companies for espionage and extortion.

How the Scheme Works: Identity and Recruitment

The core of the scheme is identity fraud. North Korean operatives obtain stolen U.S. Social Security numbers and names, often from data breaches, and create professional profiles on LinkedIn and other job boards. They may also use “clean� identities of U.S. citizens who are unaware their identity is being used. The recruitment process is meticulous:

• Fake resumes: They fabricate work histories at legitimate companies, often using real job descriptions from those firms.
• Video interview workarounds: For video interviews, they may use a U.S.-based accomplice who is paid to sit in for the call, or they may use deepfake technology to alter their appearance in real-time.
• Background checks: They pass background checks by providing fake references and using the stolen identity’s credit history, which may be clean.
• Equipment delivery: The company ships a laptop to a U.S. address (often a “muleâ€� who forwards it), and the worker then connects to it remotely from their actual location.

Once hired, the worker performs the job duties, but they also have access to the company’s network, codebase, and sensitive data. In some cases, they are instructed to install malware or exfiltrate data for espionage or to hold for ransom.

Laptop Farms: The Technical Backbone

A laptop farm is a physical location where dozens or even hundreds of laptops are set up, each one logged into a different company’s VPN or remote desktop. The farm is often in a residential apartment in a country with lax internet surveillance, such as China, Russia, or Malaysia. The laptops are typically owned by the North Korean government or a front company, and they are maintained by local operatives who may not know the full scope of the operation.

The key technology is remote desktop software (like AnyDesk, TeamViewer, or RDP). The North Korean worker, sitting in a DPRK office or a nearby country, connects to a laptop in the farm. That laptop appears to be in the U.S. (if the farm is in the U.S.) or in another approved country, so the company’s security tools see a legitimate IP address and a corporate device. The worker can then code, attend meetings, and access internal systems as if they were physically at that laptop.

Some farms are “ghost� farms where the laptops are not used by a human at all; instead, the worker uses a virtual machine or a remote desktop session that is routed through the farm to mask the true origin. The farm may also use VPNs and proxy chains to further obfuscate the connection.

How to Detect a Laptop Farm or Remote Worker Scheme

For companies, detecting these schemes is difficult but not impossible. Red flags include:

• IP address anomalies: The worker’s IP address may change frequently or not match their stated location. For example, a worker claiming to be in Texas may log in from China at 3 a.m. local time.
• Device fingerprinting: The laptop’s hardware ID, operating system, or installed software may not match the company’s standard image, or may show signs of remote control (e.g., high latency, unusual input patterns).
• Behavioral cues: The worker may avoid video calls, have a poor internet connection, or work at odd hours that don’t align with their time zone.
• Background check inconsistencies: The worker’s resume may have gaps, or their references may be unreachable or suspicious.

Companies can also use identity verification services that check for synthetic identities, and they can require periodic in-person meetings or video calls with a live camera. However, these measures are not foolproof, as the schemes are constantly evolving.

Common Problems and Risks for Employers

The primary risk is data theft and espionage. North Korean workers have been caught stealing source code, customer data, and trade secrets. In some cases, they have planted ransomware or backdoors for later use. The FBI has also warned that these workers may be used to conduct cyberattacks on the company’s infrastructure or on third parties, making the company an unwitting participant in state-sponsored hacking.

Another risk is legal and financial liability. If a company unknowingly hires a North Korean worker, it may be violating U.S. sanctions and could face fines or legal action. The company may also be forced to disclose the breach to customers and regulators, damaging its reputation.

There is also the risk of extortion: some workers have threatened to leak sensitive data unless the company pays a ransom. In one documented case, a North Korean worker who was fired threatened to release stolen data, leading to a ransom payment.

Costs and Impact on the Industry

The financial impact is twofold: companies lose money through stolen IP and extortion payments, and they may also have to pay for incident response, forensic investigations, and legal fees. The broader tech industry faces increased scrutiny and higher costs for vetting remote workers, which can slow down hiring and increase overhead.

For the North Korean government, the scheme is a lucrative revenue stream. Estimates suggest that thousands of workers can generate tens of millions of dollars annually, which is used to fund weapons development and other state activities. This makes the scheme a matter of national security, not just corporate crime.

Alternatives and Defensive Measures

Companies can reduce their risk by implementing strict identity verification, using continuous monitoring of worker activity, and conducting periodic in-person meetups or video calls with live cameras. They can also use hardware tokens that are tied to a specific device and location, making remote access harder to fake.

Another approach is to use a “zero trust� security model, where every access request is verified regardless of the device or location. This can limit the damage a remote worker can do, even if they are not who they claim to be.

Finally, companies should educate their HR and IT teams about the signs of these schemes and encourage them to report any suspicious behavior. There are also commercial services that specialize in detecting synthetic identities and remote worker fraud.

Frequently Asked Questions

How do North Korean IT workers get hired if they are in North Korea?

They often work from third countries like China, Russia, or Malaysia, where they have easier access to the internet and can receive equipment. Some may also work from inside North Korea using routed connections, but this is riskier and less common.

What is a laptop farm exactly?

A laptop farm is a physical location with many laptops, each connected to a different company’s network. The laptops are used as proxies, so the worker appears to be in the farm’s location, not their actual location.

Can a company detect if an employee is using a laptop farm?

Yes, but it requires proactive monitoring. Look for IP address mismatches, unusual login times, device fingerprint changes, and behavioral cues like avoiding video calls. Advanced detection may involve analyzing network traffic for remote desktop protocols.

Is it illegal to hire a North Korean remote worker?

For U.S. companies, it is illegal to knowingly hire a North Korean worker due to sanctions. Even unknowingly hiring one can result in legal penalties if the company fails to conduct proper due diligence.

What should I do if I suspect an employee is a North Korean IT worker?

Immediately involve your legal and security teams, and consider contacting the FBI or your national cybersecurity agency. Do not confront the employee directly, as they may be instructed to destroy evidence or flee.

Are there legitimate North Korean IT workers?

No, not in the traditional sense. The North Korean government controls all IT worker deployments, and they are considered state actors. Any remote worker claiming to be from North Korea is likely part of a sanctioned operation.

Related

• Samsung Note 4 Reset Password When Locked Out
• Fix Windows 10 Error 0x80070057 Restore
• How to Add QuickBooks Data to Microsoft Word

in workers | Number of workers | - | 5 | 1 | 100
in hours | Hours per week per worker | hr | 40 | 1 | 168
in rate | Pay rate per hour | USD | 35 | 1 | 500
out weekly | Weekly payroll | USD | workers * hours * rate | 2
out monthly | Monthly payroll | USD | workers * hours * rate * 52 / 12 | 2