Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security

The week

Most companies worry about criminals breaking in. In July 2024, a security company described what it looks like when one is hired instead.

On July 23, 2024, the security awareness company KnowBe4 published an account of how it had hired a remote software engineer who turned out to be a North Korean IT worker. KnowBe4’s business is training employees to spot scams. The post, written by the company’s founder, Stu Sjouwerman, said the role was a principal software engineer on an internal IT team working on AI. The person used a stolen US identity, meaning the real name and personal details of an actual American, and a photo altered with AI tools so that the face matched the story. KnowBe4 later showed the original stock photograph beside the edited version the candidate had submitted.

The candidate did everything a careful employer asks. According to the company, HR held four video interviews on separate occasions and confirmed that the person on camera matched the photo on the application. Background checks and reference checks came back clear, because the identity behind them belonged to a real person. On paper and on screen, this was a qualified hire.

Then the laptop arrived. On July 15, the company-issued Mac began loading malware, malicious software designed to give an outsider control of a machine or to steal what is on it, as soon as it was received. The endpoint detection software on the device, the monitoring agent installed on every company laptop, raised an alert. It went to KnowBe4’s security operations center, the group that watches the company’s computers and network around the clock. According to the company’s timeline, the suspicious activity began at about 9:55 p.m. Eastern time.

What happened next took less than half an hour. The security team contacted the new hire, who said he had been following the steps in a router guide to fix a speed problem and that this might have caused a compromise. He then said he was unavailable for a call and stopped responding. At about 10:20 p.m., the team contained the device, cutting it off before it could do damage.

KnowBe4 said the activity included manipulating session history files, transferring potentially harmful files and running unauthorized software. The person had used a Raspberry Pi, a small and inexpensive single-board computer, to download the malware. The company said no illegal access was gained and no data was lost, compromised or exfiltrated.

Part of the reason the damage was limited lay in a design choice made long before this hire. KnowBe4 said new employees start in a tightly restricted environment, without access to production systems. The company also shared what it had collected with Mandiant, the incident response firm, and with the FBI. The investigators concluded that the new hire was a North Korean IT worker. Because the FBI investigation was active, the post held back some detail.

The post also described how the scheme generally works. The worker asks for the laptop to be shipped to what KnowBe4 called an IT mule laptop farm. The worker then connects to it over a VPN from abroad, and works overnight in their own time zone so that the activity looks like a US working day. The salary is paid, and much of it is sent on to fund the regime’s programs.

KnowBe4 closed with practical advice. It suggested scanning remote devices for unauthorized remote access and checking that candidates are physically where they claim to be. It also flagged any shipping address that differs from the candidate’s stated location. It warned against relying on references that come only by email, and it listed warning signs such as VoIP phone numbers, a thin digital footprint and inconsistent personal details.

KnowBe4’s story did not come out of nowhere. In May 2022 the State Department, the Treasury Department and the FBI had issued joint guidance on North Korean IT workers, including red flags for employers. The Office of the Director of National Intelligence followed with an advisory in July 2023. The United States and South Korea issued updated guidance in October 2023, and the FBI published a public service announcement in May 2024. The idea behind all of them is simple: skilled programmers, working under false identities, collect Western salaries that end up funding a heavily sanctioned government.

These schemes usually need help on American soil. In May 2024 the Justice Department had charged an Arizona woman with running a laptop farm that hosted company devices for such workers. The FBI had searched her home the previous October. A laptop farm is a home or other location in the US where company-issued laptops are kept plugged in and online. A worker overseas controls them remotely, while the employer believes its new hire is sitting at a desk in America.

What made KnowBe4’s account valuable was its candor. A company that teaches others about deception admitted it had been deceived, and explained how. An employer that discovers a fraudulent hire can treat it as a personnel matter and say nothing. Publishing a timeline, the warning signs and the doctored photo gave other employers a concrete case to test their own process against. For any leader who hires remotely, it raised an uncomfortable question: would our process have caught this person, or would we have simply shipped the laptop?

The April 2022 TraderTraitor advisory showed North Korean operators using fake job offers to reach employees at crypto firms. In that pattern, the attacker played the recruiter and lured a target with an attractive opportunity. The KnowBe4 case runs the other way. Here the operator is the candidate, and the employer delivers credentials and a laptop on day one.

That reversal matters, because it changes where the weakness lies. A phishing lure has to defeat a person’s judgment once. A fraudulent hire has to keep up a performance for weeks or months. In exchange, the organization hands over everything an attacker normally has to steal: an account, a device, network access and a reason to be there. The scheme does not need to defeat any single control. It needs to pass a chain of hand-offs, each owned by a different team that sees only its own step:

• Recruiting runs the interviews.
• HR and a screening vendor run the background check.
• IT ships the device.
• Security and the hiring manager watch the work.

There are four hand-offs: interview to offer, offer to onboarding, onboarding to device, and device to daily work. At each one, the question is whether the identity verified at the previous step is the identity now in front of the organization. In a relay race, the baton can be dropped at any exchange. In a hiring process, it can be swapped.

The sections below first set out the moving parts of the scheme, then take the four hand-offs in order. They then describe what one continuous identity thread looks like, how to run it without alienating honest candidates, why ownership is the gap, and the questions a leadership team should be able to answer.

The moving parts of the scheme

Five elements make the scheme work, and each shapes what employers need to check.

Who is doing this, and why. According to repeated US government warnings, North Korea places skilled IT workers in remote jobs abroad, often in software development, under false identities. Their salaries generate revenue for the regime. The May 2022 joint guidance estimated that an individual worker could earn up to $300,000 a year. Some do adequate work for months. Others, as KnowBe4 found, also try to install malware.

The roles they seek follow a pattern. Remote software development, data engineering, IT support and web work pay well, are routinely filled without an in-person meeting, and are judged by output rather than presence. A ticket closed overnight looks the same as a ticket closed at noon. Those features, which make remote technical hiring efficient for honest employers, are the same features the scheme relies on.

Stolen or borrowed identities. The worker applies under the name, Social Security number and work history of a real American, sometimes someone whose details were stolen, sometimes someone who lends them willingly. Photos can be edited with AI tools so that a face matches a document closely enough to pass a casual look. Résumés are often assembled from real professional profiles, which means the work history is plausible because it belongs to someone.

Proxies. Some schemes use proxies, other people who sit interviews on the worker’s behalf, so the person who impressed the interview panel is not the person who later does the job. The reverse also happens: one fluent speaker handles the calls while others do the work behind the account.

Laptop farms and remote control. Once hired, the worker needs the company laptop to appear to be in the US. A facilitator receives the device, keeps it powered and connected, and installs remote access software. These programs let someone in another country see the screen and use the keyboard as if they were sitting there. Commercial VPNs, services that disguise where internet traffic really comes from, add another layer of camouflage. Facilitators can also handle the money: receiving direct deposits, forwarding funds abroad and filing the paperwork that makes the employment look normal.

Sanctions. North Korea is subject to broad US sanctions, laws that forbid most financial dealings with the regime. That makes the issue one of legal compliance as well as security, as discussed below.

Each element defeats a different control. Stolen identities defeat records checks. Edited photos and proxies defeat interviews. Laptop farms defeat location assumptions. And facilitators defeat payroll checks that look only at whether a bank account is in the United States. With those pieces in view, the four hand-offs become easy to see.

Hand-off one: interview to offer

A background check confirms that a name, Social Security number and history belong to a real person with a clean record. It does not confirm that the person on the video call is that person. This is the single most common misunderstanding about hiring checks. A clean background check on a stolen identity is, by design, a clean background check.

Why records checks pass

A typical pre-employment screen is run by a consumer reporting agency under the Fair Credit Reporting Act. It starts with a trace of the Social Security number to find names and addresses linked to it. It then searches criminal records in the places those addresses point to, and may confirm past employment and education. Every one of those steps is keyed to the identity the candidate supplies. If that identity is real and clean, the results are real and clean. KnowBe4 noted afterward that its checks had shown inconsistencies in the names used, a signal that is easy to miss when the overall result is a pass.

Federal advisories describe schemes built on stolen or borrowed US identities, edited photos and résumés copied from real profiles. Some use proxies who sit interviews on the worker’s behalf. References can be part of the construction too. A reference who answers only by email may be another member of the same operation, which is why KnowBe4 advised against relying on references that come only by email.

Binding a face to a document

Controls at this hand-off compare a government document to a live person and bind the result to the candidate record. In practice, that means an identity verification step, often run by a specialist vendor. The candidate shows a passport or driver’s license on camera, the system checks that the live face matches the photo, and the outcome is recorded against that candidate’s file.

The mechanics matter. A good check does three things. It inspects the document for signs of tampering. It tests that the face in front of the camera belongs to a live person rather than a replayed video or a mask. And it compares that face with the photo on the document. Each step can fail. Documents can be forged well. Liveness tests are in a running contest with video manipulation tools. Face matching produces both false matches and false rejections. A vendor’s check raises the cost of impersonation sharply, but it is not proof.

The check also creates obligations. Biometric data is regulated in some states, most notably Illinois under its Biometric Information Privacy Act, which requires written notice and consent before collection. Employers need a retention schedule, a consent step and a contract that limits what the vendor may do with face data. Counsel should review the design before rollout, not after the first complaint.

What interviewers can notice

Interview teams should look for patterns that are weak on their own and strong together:

• a phone number on a VoIP service, an internet-based phone line that is easy to set up without tying it to a real address;
• a work history no reachable colleague can confirm; and
• reluctance to turn on a camera.

Any one of these has innocent explanations. Several together deserve a closer look. Interviewers can also ask ordinary questions about the candidate’s claimed city, school or previous team, the kind of detail a real person answers without effort. Recruiting systems can help by flagging applicants who share a phone number, an email pattern or large blocks of identical résumé text with other applicants, which can point to one operation submitting many profiles.

Recruiters need a route to escalate a doubt to security without being forced to make an accusation. A recruiter who feels something is off should be able to send a short note to a named person and move on, rather than either confronting the candidate or swallowing the concern. That route only works if recruiters are not penalized for slowing a hire. Many recruiting teams are measured on time to fill. A flag that adds a week to a requisition looks like a missed target unless leadership has said otherwise.

For roles with privileged access, one in-person step before the offer raises the cost of impersonation more than any software check. It can be a meeting at an office, a visit to a partner location or a session with a notary or identity service that confirms the person in front of them matches the document. A worker operating from abroad cannot attend, and a proxy who attends must then be the person who does the job.

Hand-off two: offer to onboarding

The person who completes onboarding is not always the person who interviewed. Proxies can pass interviews and hand over the job, or the reverse. This hand-off is where HR paperwork, payroll setup and identity proofing meet, and it is the cheapest point to re-verify.

What Form I-9 and E-Verify do and do not prove

Employment eligibility checks do not close the gap on their own. Every US employer must complete Form I-9, which confirms that a new hire is allowed to work in the country. The employee completes the first section by the first day of work, and the employer must examine documents and complete its section within three business days. E-Verify is a government system that checks I-9 information against federal records.

Since August 2023, employers enrolled in E-Verify may examine Form I-9 documents remotely over live video. The alternative procedure requires the employer to review copies of the documents, conduct a live video session with the employee and keep copies. That shows a document looks genuine. It says little about whether a stolen document belongs to the person holding it up. E-Verify’s confirmation, in turn, shows that the name and number are valid together, which a stolen identity satisfies by definition.

The I-9 process also limits what an employer may demand. Employers may not specify which acceptable documents a new hire presents, and over-asking can create discrimination exposure. Identity proofing for security purposes should therefore run as a separate, documented step with its own legal basis, rather than as extra demands bolted onto the I-9.

Re-verify the same way

A live identity check at onboarding, by the same method used before the offer, closes the gap. The aim is consistency: if the face and document matched at the interview stage, they should match again, in the same way, when the person starts. If the vendor stores a reference template from the first check, the second check can compare against it directly. If not, a reviewer can compare the two results side by side.

Payroll as a security signal

Payroll data is a strong signal. Requests to pay into accounts at unfamiliar payment services, frequent changes of bank details and tax addresses that differ from the verified home address all deserve a second look. Payroll teams see these details every day, but they are rarely asked to treat them as security information.

The mechanism explains why. In the Arizona case, court records described a facilitator who received wages by direct deposit into her own accounts and forwarded proceeds abroad. Income was reported to tax authorities under the stolen identities. A deposit account whose holder name does not match the employee is therefore a meaningful flag. So is a request, soon after the start date, to move pay to a new institution. Payroll providers and banks offer account validation services that can confirm whether an account is open and whether the name matches. Using one at setup costs little.

The people whose identities are borrowed bear part of the cost. They may receive tax notices about income they never earned. When such a notice reaches an employer through a verification request, it deserves to go to security as well as to a payroll queue.

The sanctions dimension

Employers should also remember the sanctions exposure. Paying a worker who is in fact acting for North Korea can create liability under US sanctions law even when the employer did not know. Civil penalties from the Treasury’s Office of Foreign Assets Control are assessed on a strict liability basis. The agency does weigh factors such as the strength of a firm’s compliance program when deciding whether and how to act. That makes this a question for the compliance function and counsel as well as HR.

For banks, insurers and other regulated firms that already run sanctions screening on customers, the obvious next step is to check whether the same discipline is applied to their own workforce and contractors. OFAC’s 2019 framework for compliance commitments describes management commitment, risk assessment, internal controls, testing and training. Those five components map onto a hiring process as readily as onto a customer onboarding process. Screening a name against the sanctions list will not catch a stolen American identity. The value comes from the risk assessment and controls around it.

Export controls are a separate exposure. Some companies hold technical data controlled under the International Traffic in Arms Regulations or the Export Administration Regulations. They may face a violation if a foreign person reaches that data, whatever the person’s job title says. Defense suppliers and manufacturers should treat a fraudulent hire as a potential export incident as well as a sanctions one.

Hand-off three: onboarding to device

The laptop farm model depends on employers shipping a device to a US address. A facilitator keeps it powered and connected so that the worker can control it remotely from abroad. Device logistics are therefore an identity control, though they rarely sit with anyone who thinks about identity. The person who books the courier is usually in IT operations or facilities, focused on getting equipment out on time.

Shipping rules

Practical measures are simple:

• Ship only to the address verified during proofing.
• Flag a change of shipping address shortly before or after the start date.
• Require in-person pickup for privileged roles where feasible.

A further check costs almost nothing: compare shipping addresses across all recent hires. One facilitator may receive devices for several workers, and a single residential address receiving laptops for unrelated new employees in different teams is a strong signal. Few organizations look, because the addresses sit in a logistics system no one in security queries. Courier tracking that requires a signature from the named employee adds a modest layer, though a facilitator can sign.

What the laptop can and cannot see

Once the device is live, endpoint and network tools, the monitoring software on laptops and the systems that watch traffic leaving the company, can show the warning signs. Look for remote access software the organization did not install, connections routed through commercial VPNs, and a machine that is always on with keyboard activity that does not match a normal workday.

Each signal has a known weakness. Remote access software is visible to endpoint tools, so more careful facilitators can use hardware instead. A small device captures the laptop’s video output and injects keyboard and mouse input, controlled over the network. To the laptop it looks like a monitor and a keyboard. Endpoint teams can still catch it by alerting on unusual connected peripherals and display devices on new hires’ machines, which most device management platforms can report.

Network location is weaker than it looks. A laptop in a US home connects through a US residential internet provider, which is exactly what an honest remote employee’s laptop does. The more useful signals are combinations: the device’s network location against the verified address, sign-ins to the same account from other countries, and several company devices appearing behind the same home connection.

Organizations that issue no laptop at all, and instead give remote staff a virtual desktop reachable from a personal device, face a different version of the problem. Nothing is shipped, so there is no address to verify, and the endpoint is a device the company cannot inspect. For those organizations, sign-in conditions, device health checks and session monitoring carry the load that shipping rules carry elsewhere.

The data usually exists already. What is missing is a rule that tells someone to look for it during a new hire’s first weeks. Security teams are typically tuned to spot outside attackers, not to scrutinize the behavior of a colleague who has just joined.

Hand-off four: device to daily work

KnowBe4 caught its hire because the security team saw malware on a new workstation within hours. Most schemes make less noise. The worker does the job, often adequately, while the salary funds the regime. Detection then depends on the manager and on access design.

Staged access

Access can grow with tenure, so a new engineer cannot reach production systems, the live systems that customers use, or code repositories, the central stores of a company’s software, on day one. This is sometimes called staged access, and it is good practice regardless of this particular threat, because it limits what any single new account can damage. KnowBe4’s own restriction on new hires is the clearest evidence that it works.

Staged access has a cost that engineering leaders will raise immediately. New engineers are expected to ship early, and a narrow sandbox slows them down. The usual compromise gives a new hire a development environment with realistic but synthetic data and read access to the team’s repositories. It grants no standing access to secrets, customer data or production. Broader access then comes through a request that a manager approves and that expires. Required code review by a second engineer adds a separate safeguard that catches malicious changes as well as mistakes.

What managers and monitoring can see

Monitoring can be more sensitive in the first weeks, under a policy staff know about. Managers can be told which patterns to raise: refusal to appear on camera, odd working hours relative to the claimed location, or sudden requests for broader access. Other signs are subtler: a voice or writing style that changes from week to week, quality that swings sharply, or a worker who seems to be juggling several jobs at once.

On the technical side, useful rules for new accounts include sign-ins to one account from several countries within a short time and bulk cloning of code repositories. Others cover uploads to personal cloud or code hosting accounts, and access tokens used from devices the company did not issue. Each rule is cheap to write. Each produces false positives, which is why they work best when scoped to the first weeks of tenure and reviewed by someone who knows the hiring context.

Employment and privacy law shape what monitoring is permitted, so counsel should review the design. Some states require employers to give notice of electronic monitoring; New York’s law took effect in 2022. Organizations with staff in Europe face stricter limits under data protection law and, in some countries, works council consultation. A policy written for one jurisdiction will not travel unchanged.

The contractor gap

Staffing firms and contractors sit outside all four hand-offs unless the contract pulls them in. A company can have excellent controls for its own employees and none for the contract developers working beside them. Agreements should require the same identity proofing, device shipping rules and notice obligations the employer applies to its own hires. They should also give the client the right to audit them.

Three clauses do most of the work. The first requires the supplier to verify identity by a stated method and keep evidence the client can inspect. The second prohibits subcontracting the client’s work without written approval, since schemes often hide one layer down. The third requires notice within a short, fixed period if the supplier suspects a worker on the client’s account is not who they claim. Offshore development centers and managed service providers deserve the same treatment, even when the client never ships them a device.

One identity, carried through

Suppose a mid-sized insurer is hiring a remote data engineer. Under its old process, recruiting ran three video interviews, a vendor ran a background check and HR completed the I-9. IT shipped a laptop to whatever address the new hire entered in the onboarding portal, and the engineer was given the same access as the rest of the team on day one. Each team did its job well. No team checked that the person at the end was the person at the start.

Under a redesigned process, the candidate completes a live document-and-face check before the offer, and the result is attached to the candidate record. At onboarding, the same check is repeated and compared. The laptop ships only to the verified address, and a late change triggers a call from security. For the first month, the engineer works in a development environment without access to customer data, and the security team runs a short list of first-weeks rules on the device. The contracting firm that supplies additional engineers signs up to the same steps.

Each of these steps is cheap. Together, they convert four separate checks into one continuous thread.

The record that ties it together

The thread needs somewhere to live. In most organizations the relevant facts are scattered. The proofing result is in a vendor portal, the address in the HR system, the device serial number in the asset system and the accounts in the identity platform. A fraudulent hire passes partly because no single record joins them.

The fix is a small data model rather than a new platform. Each hire gets one identifier that links the proofing result, the verified address, the payroll account, the device serial number and the accounts created. The identity platform can hold it as an attribute. A weekly report can then list exceptions: hires with no second proofing check, devices shipped to an address other than the verified one, payroll accounts whose holder name did not validate.

Evidence and metrics

An auditor or examiner who asks how the organization knows its staff are who they claim will want evidence, not policy text. Useful evidence includes the proofing results for a sample of hires, the exception reports and how each exception was resolved, and contract clauses for staffing suppliers. Useful metrics include the share of hires with matching pre-offer and onboarding checks, the number of address changes flagged and the time added to onboarding. The last one matters, because a control that adds two weeks will be bypassed.

Verification most candidates barely notice

A well-run program does not turn hiring into an interrogation. Most candidates are exactly who they say they are, and a process that treats every applicant as a suspect will cost an organization good people. The goal is a light, consistent thread of verification that most candidates barely notice and that a fraudulent one finds very hard to keep up.

In practice, that means:

• One named owner. A single function, often security working with HR, is accountable for the identity of each new hire from first interview to the end of the probation period.
• The same check, twice. A live document-and-face check before the offer and again at onboarding, recorded in the same place, so a swap between the two shows up.
• Logistics treated as security. Device shipping rules written by security and followed by whoever books the courier.
• A first-weeks watch list. A short set of device and network rules applied to new hires, under a policy staff have been told about.
• Staged access. New accounts start narrow and widen with tenure and need.
• Contractors inside the fence. Staffing agreements that require the same steps and allow audit.

Where programs fail, the cause is usually an assumption:

• Believing the background check verifies the person. It verifies the identity, which may be stolen.
• Treating each team’s check as complete in itself. Every step can pass while the chain fails.
• Shipping to whatever address the portal says. The address is often the weakest link in the whole process.
• Giving day-one access to everything because it is easier for the team and avoids a ticket queue.
• Forgetting contractors and staffing firms, who can bring the same risk through a side door.
• Designing monitoring without counsel, which can create employment and privacy problems of its own.

Fairness and consistency

The controls carry a discrimination risk if they are applied unevenly. Federal law prohibits employment discrimination based on national origin. A process that sends candidates with foreign-sounding names, accents or overseas degrees to extra scrutiny invites claims and loses talent. The defensible approach is to apply the same checks to every candidate for a given class of role. Escalation should rest on observable inconsistencies, such as a mismatched shipping address or a reused phone number, rather than on who the candidate appears to be.

Accessibility needs attention too. Some honest candidates lack a passport, have a disability that makes a camera-based liveness test difficult, or cannot travel for an in-person step. Each check needs a documented alternative that offers comparable assurance, such as an in-person visit to a notary or partner office instead of a video check.

Sector notes

In financial services, the sanctions angle is especially sharp, because firms already have sanctions compliance teams and examiners who expect them to know who they are paying. Insured banks also operate under Section 19 of the Federal Deposit Insurance Act, which bars people convicted of certain crimes from working there without regulatory consent. Federally insured credit unions face a parallel provision. Those rules push banks toward fingerprint-based checks for many staff. Broker-dealers have an older and stronger tool: SEC Rule 17f-2 requires fingerprinting of many associated persons. A fingerprint is collected in person, so it ties the record check to a body in a way a name-based search cannot.

In healthcare, a remote engineer with access to systems holding patient records raises the stakes of a data breach, with all the notification duties that follow. The HIPAA Security Rule asks covered entities and business associates to consider workforce clearance procedures that confirm a person’s access is appropriate. Health systems already screen staff against federal exclusion lists, but those checks are name-based and share the background check’s blind spot. Ambulatory networks and smaller practices that rely on outsourced IT support should look hardest at their contractor terms, because that is where remote technical work tends to concentrate.

In government and among government contractors, staged access and contractor clauses carry extra weight, because so much technical work is done by outside firms rather than by public employees. Federal employees and contractors who receive a Personal Identity Verification card go through in-person identity proofing and fingerprinting under Homeland Security Presidential Directive 12. Agencies and police departments that handle criminal justice information must meet the FBI’s CJIS Security Policy, which requires fingerprint-based checks for personnel with unescorted access. State and local agencies outside those regimes, and the vendors that serve them, vary widely. A county IT department that hires remote contractors through a staffing firm may have none of these protections unless it writes them in.

In every sector, the same practical step comes first. Draw the four hand-offs on a single page and write the name of the team that owns each one. Then ask who checks that the identity carried from one to the next is the same.

Four risks, and no single owner

The risks stack up quickly. There is security risk: a hostile actor inside the network with legitimate credentials. There is legal risk: possible sanctions liability for payments to a worker acting for North Korea. There is data and regulatory risk if customer information is reached. And there is reputational risk, especially for firms whose customers trust them with sensitive data or money.

Each risk has its own clock. The security risk starts on the first day the account is live. The regulatory risk can start a countdown once an incident is identified. Banking organizations must notify their primary federal regulator of significant computer-security incidents within 36 hours of determining one has occurred. Federally insured credit unions have a 72-hour reporting requirement to the NCUA. Public companies must assess whether an incident is material and, if it is, disclose it within four business days. A fraudulent hire who reached sensitive systems can trigger any of these, and the legal teams involved will need to know quickly what the person could reach.

The design point is that no single team owns this problem today. Recruiting optimizes for speed and candidate experience, HR for compliance paperwork, IT for getting equipment out, and security for outside threats. Fixing it means assigning one owner for the identity of each new hire, from first interview to the end of the probation period.

Where ownership should sit

Two models work. In the first, an insider risk function inside security owns the thread and HR, IT and procurement each own a named step with an agreed handover. In the second, HR owns it, with security setting the standard and reviewing exceptions. The first fits organizations that already run insider risk programs, such as large banks and defense contractors. The second suits smaller organizations, where HR is the only function that touches every hire. Either works if the owner has authority to pause a start date.

The case against, and why it still holds

The strongest objection is proportionality. Most organizations will never knowingly meet a North Korean IT worker, and every added check slows hiring in a tight market. The objection has force for roles without system access. It is weaker for remote technical roles, where one bad hire receives credentials, a device and a reason to be on the network. The controls described here also catch other kinds of hiring fraud, from one person secretly holding several full-time jobs to résumé fraud, so the benefit does not depend on the specific adversary.

A second objection is that a determined state actor will defeat any check. That is partly true and beside the point. The goal is to raise the cost of each step, so that schemes move to easier targets, and to limit what a hire who does get through can reach.

Who checks the thread

1. Who in our organization is responsible for confirming that the person we hired is the person who interviewed?
2. Do we compare a government document to a live face before making an offer, and again at onboarding?
3. Where do we ship laptops, and what happens if a new hire changes the shipping address just before starting?
4. Would our security team notice unapproved remote access software or always-on activity on a new hire’s device in the first weeks?
5. Do our staffing firm and contractor agreements require the same identity, shipping and notice controls we apply to our own staff, and can we audit them?

A leadership team that cannot answer the first question has found its starting point. The remaining four usually have partial answers spread across several teams, and the useful exercise is to collect them in one room. Take the last ten remote technical hires and trace each one through the four hand-offs, using the actual records rather than the policy. The gaps tend to show up in the first two or three cases.

The answers also change over time. Contract terms lapse, new staffing suppliers arrive without the clauses, and shipping rules erode when a rush hire needs a laptop by Monday. A short review twice a year, owned by the same person who owns the thread, keeps the controls from decaying into paperwork.

With hindsight

In the year after KnowBe4’s disclosure, government action intensified, and the nature of the threat shifted in a way that matters for every employer.

KnowBe4 itself kept the story open. In October 2024 it updated its post with a list of changes to its own hiring process, which turned a one-off incident report into a reference that other employers could compare against.

The Justice Department kept pursuing US-based facilitators, the people who receive laptops and keep them running. In October 2024, searches at eight locations in three states recovered more than 70 laptops and remote access devices, according to a later department announcement. In December 2024 it indicted 14 North Korean nationals over an IT worker scheme that included extortion.

In January 2025 an FBI public service announcement warned that workers who were discovered had begun stealing source code, the underlying instructions that make a company’s software work. They were then extorting employers, threatening to release stolen data unless paid. The FBI said some had already published victims’ code. The same notice described workers copying company code repositories to personal accounts. They also harvested credentials and session cookies, small files that keep a user signed in, to start work sessions from devices the company did not control.

The January 2025 notice also confirmed that the interview stage was getting harder. The FBI said the workers used AI and face-swapping tools during video interviews, and reused phone numbers and email addresses across multiple résumés. Its recommendations read like a map of the four hand-offs. It advised verifying identity during interviewing, onboarding and throughout employment, and cross-checking applicants for shared contact details. It urged training HR staff to watch for changes of address or payment platform during onboarding. It also recommended auditing staffing firms and completing as much of hiring and onboarding in person as possible.

The Arizona facilitator charged in May 2024 pleaded guilty in February 2025 and in July 2025 was sentenced to 102 months in prison. Prosecutors said her scheme had touched more than 300 US companies and generated more than $17 million in revenue for her and for North Korea. The court record described 68 stolen identities, more than 90 laptops seized from her home, and dozens of devices shipped abroad, including to a Chinese city on the North Korean border. The victims included Fortune 500 companies, an aerospace manufacturer, a carmaker and a major television network. Workers had also tried, generally without success, to get jobs at two US government agencies.

That list is worth pausing on. A single facilitator’s operation reached hundreds of employers across ordinary industries, which suggests this is a broad pattern rather than a problem for a few unlucky technology firms.

In June 2025 the Justice Department announced coordinated actions under its DPRK RevGen initiative, including searches of 29 known or suspected laptop farms across 16 states. The announcement said North Korean actors had obtained remote jobs at more than 100 US companies. In one case an overseas co-conspirator had reached files at a California defense contractor, including technical data controlled under the International Traffic in Arms Regulations. Another charged four North Korean nationals over the theft of virtual currency worth more than $900,000. Those cases moved the risk beyond salaries and source code into export control and direct theft.

The extortion turn changed the economics for employers. Before it, a fraudulent hire looked mainly like a sanctions and payroll problem: money paid to the wrong person, and a legal exposure to manage. After it, a fraudulent hire is a data breach waiting for a trigger. The moment the worker is discovered, the employer may face a demand to pay or see its code and data published.

Some assumptions from 2024 held up and some did not. The idea that a background check verifies the person was already weak, and the later cases removed any doubt. The expectation that a careful video interview would catch an impostor weakened further as face-swapping tools improved. What held up best were the controls that require physical presence or a physical object: in-person steps, shipping rules and devices the company controls. Staged access also proved its worth, both in KnowBe4’s case and in the later cases where the damage depended on what the worker could reach.

That makes the device and early-access controls described above the most urgent of the four. Verifying identity at interview and onboarding reduces the chance of hiring the wrong person. Shipping rules, first-weeks monitoring and staged access limit what that person can take if one gets through. The practical response is to treat the first weeks of every remote hire’s tenure as a period of deliberate, disclosed caution. It also means planning the response to discovery in advance: who cuts access, who preserves evidence, who calls counsel and law enforcement, and who decides how to answer an extortion demand.