North Korean IT Workers Did Not Hack Anyone. They Got Hired.

The most unsettling detail in the latest case against North Korean IT workers is how ordinary it all looks. Nobody broke in. Someone applied for a job, passed an interview, and was handed a laptop and a login. That is the view in an indictment the US Justice Department announced this week, which charges 14 people. The accusations are unproven.

This is a hiring failure first and a hacking story second, and most firms are not set up to see it that way.

No exploit required

Because they rely on people rather than code, North Korean IT workers are hard to catch with technical tools. Prosecutors say the scheme reached more than 70 US companies and earned about $3 million between 2019 and July 2025. The tools were stolen identities, helpers who hosted laptops in their homes, and bank accounts set up to move the pay.

There is no zero-day, no phishing kit and no malware in that list. A firewall would not have stopped any of it, and a vulnerability scan would not have found it. The weak point was a person who accepted a CV at face value.

North Korean IT workers exploit trust, not code

The FBI says North Korea’s government gets about 85 to 90 percent of the money these workers make. So each placement is worth real effort, and the effort shows. CrowdStrike reports fake police reports to redirect replacement laptops, and device spoofing since May 2026 that made a video capture card pass as a webcam.

Still, law enforcement has now raided more than 40 laptop farms in Texas and seized about 187 devices. That is a real result. But CrowdStrike says the disruption will likely slow the operation only in the areas where farms were shut down. The rest of the model survives, because it depends on a gap in how companies verify people.

Why this is not just an American problem

So are UK firms safe? Not really. British firms hire remotely, use contractors and buy staff through agencies, just as the American victims did. Those victims were not defence giants. They were firms in health care, communications, retail and manufacturing.

Some IT managers might reasonably say that HR owns hiring. The FBI disagrees, and it has a point. It tells employers to coordinate across IT, HR, security and management, because each team sees only a slice of the behaviour.

What to do first

• Add a live video ID check at offer stage and again on day one.
• Send hardware only to a verified address and confirm any change by phone.
• Alert on remote access software and KVM-over-IP devices on staff laptops.
• Ask your recruitment agencies how they verify identity.

Keep the checks even-handed. The FBI cautions that blocklists and heavy-handed controls can penalise legitimate workers and identity theft victims.

Test the part nobody tests

Most security testing starts at the network edge. This case starts inside, with a trusted account. An internal penetration test, or a social engineering exercise aimed at your onboarding process, would tell you what a convincing impostor could reach in their first week.

If the answer is “quite a lot”, the fix is partly technical and partly a matter of process. Both are cheaper to fix before a headline than after.

The uncomfortable economics

Consider the incentives. A fraudulent worker who holds a job for a year can earn a full salary. The FBI estimates that most of it flows to the North Korean government. Each extra verification step raises the cost of the fraud. So the checks that matter are the ones that are expensive to fake, such as live verification and physical device control.

That is also why the helpers matter so much. Without a person in the US to receive a laptop and open a bank account, the whole scheme gets harder. Prosecutors have charged and arrested US nationals in this case for exactly that role.

A note on fairness

None of this should turn into suspicion of every overseas applicant. The FBI is explicit that name-based filtering is unreliable and can harm qualified people. So the goal is a consistent process for all candidates, whether or not they resemble North Korean IT workers. Treat odd signals as questions to ask, and escalate only when several line up.

Done well, the same checks make life harder for impostors and no harder for honest candidates. That balance is worth getting right.

What this means for small firms

A large employer can afford a vetting team. A forty-person company cannot. But the small firm is just as likely to need a remote developer, and just as likely to take a polite candidate at their word. Simple habits help most: speak to the person on camera, ship kit to a confirmed address, and keep a list of the software that should be on every laptop.