North Korea deploys teams of IT workers who pose as Americans or other foreigners to get remote tech jobs, then send their paychecks back to the regime. A cache of leaked internal files gave researchers an unusual look at how ordinary and organized that work is: job tracking spreadsheets, equipment lists and payment charts. Since then, US prosecutors have charged and sentenced a growing number of the people who help the scheme run. Here is how it works, what the leak showed, and how employers can spot a fake applicant.
How the remote IT worker scheme works
The playbook has been described in detail by the FBI and the Justice Department, and it follows a fairly consistent pattern:
- Fake identity: workers build profiles using stolen or rented personal details of real people, including names, addresses and Social Security numbers.
- Applications: they apply for remote software, web and blockchain jobs on job boards and freelance platforms, often with polished resumes and coding portfolios.
- Interviews: the FBI warns that some use AI tools and face swapping software to get through video interviews.
- Laptop farm: once hired, the company ships a work laptop to a US address. A facilitator keeps it switched on and installs remote access software so the worker can log in from overseas.
- Money trail: salaries are paid into accounts controlled by the network and moved on to North Korea, where the United Nations estimated in 2024 that the schemes earn $250 million to $600 million a year.
Some workers also abuse their access. In January 2025, the FBI warned that North Korean IT workers had copied company code repositories and stolen data, then extorted employers after being discovered.
What the leaked files revealed about daily life
The leaked material, reviewed by an independent security researcher and by analysts at security firms DTEX and Palo Alto Networks, looked less like a spy thriller and more like an office back end. The analysts who examined it said it matched activity they had already been tracking.
Daily updated sheets listed open roles, the hiring companies, their locations and a status for each application.
Lists of each worker’s computer, monitors and drives, down to serial numbers.
AI, blockchain, web scraping, bots, mobile and web apps, trading tools and desktop software, each with budgets.
Graphs tracking earnings, the most profitable regions and which pay schedules worked best.
Researchers described a quota driven culture where everything is recorded. After being contacted about the accounts involved, GitHub suspended three developer accounts under its rules against spam and inauthentic activity, and Google said it has processes to detect such operations and report them to law enforcement.
DOJ and FBI actions so far
The Justice Department and FBI run a joint effort called the DPRK RevGen: Domestic Enabler Initiative, which targets the people inside the United States who make the scheme possible. Key steps on the public record:
| When | Action |
|---|---|
| December 2024 | Indictment of 14 North Korean nationals tied to at least $88 million over six years |
| January 2025 | FBI public warning about data theft and extortion by IT workers |
| June 30, 2025 | Nationwide action: searches of 29 known or suspected laptop farms in 16 states, about 200 computers, 29 financial accounts and 21 websites seized |
| 2025 | Arizona facilitator Christina Chapman sentenced to more than eight years in prison for a laptop farm linked to over 300 US companies and more than $17 million |
| April 15, 2026 | New Jersey men Kejia Wang and Zhenxing Wang sentenced to 108 and 92 months for a scheme that reached more than 100 US companies and earned over $5 million |
| May 2026 | Matthew Knoot and Erick Ntekereze Prince each sentenced to 18 months, in cases that hit almost 70 companies |
In the Wang case, the Justice Department said eight other defendants charged in June 2025 remain at large, and the State Department’s Rewards for Justice program offers up to $5 million for information on related financial activity. Victim companies in that case alone reported at least $3 million in damages, including legal and network cleanup costs.
How companies can spot a fake remote applicant
The FBI’s guidance for employers focuses on identity checks and on watching for technical red flags after hiring:
- Verify identity during interviews, onboarding and throughout employment, not just once.
- Cross check your HR system for other applicants using the same resume text, phone number or email address. Internet phone numbers reused across resumes are a known sign.
- Be alert to last minute changes in shipping address or payment platform during onboarding.
- Ask casual, specific questions about the applicant’s claimed location and education.
- Do as much of the hiring and onboarding in person as possible.
- Audit staffing agencies and contractors that supply remote workers.
- Limit admin rights, block unapproved remote desktop tools, and investigate logins from several countries in a short time.
FAQ
What is a laptop farm?
It is a home or office in the US where a facilitator keeps company laptops running and connected so overseas workers can control them remotely and appear to be working from inside the country.
Are US citizens who help the scheme prosecuted?
Yes. Facilitators have been charged with wire fraud, identity theft and money laundering conspiracies, and several received prison sentences in 2025 and 2026.
Is it illegal for a company to pay a North Korean worker by accident?
Paying North Korean nationals can break US sanctions rules. Companies that discover such a worker should stop payments, preserve evidence and contact the FBI and legal counsel.
Why does North Korea do this?
US officials say the wages are funneled to the North Korean government and help pay for its weapons programs, despite international sanctions.
The verdict
The leaked files confirmed that North Korea’s remote IT worker operation is a disciplined, profit focused business, and US prosecutors have spent the past two years dismantling its domestic support network. For employers, the best defense is unglamorous: verify identities repeatedly, watch onboarding details, lock down remote access and report anything suspicious early.
Updated October 2026: expanded into a full explainer on the scheme, the leaked records, US enforcement through 2026 and FBI hiring advice.
Featured photo: Clint Patterson on Unsplash.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
