Hidden in Plain Sight: Labor, Employment and Cybersecurity Risks of DPRK IT Worker Infiltration

Are you a U.S. employer with a substantial remote workforce? Do you operate in a regulated industry where safeguarding sensitive data, personal information or intellectual property (IP) is paramount? Does your organization onboard employees virtually and ship company equipment to remote locations – perhaps to workers you've never met face to face? If any of these descriptions fit your company, you need to know about an emerging threat that may already be infiltrating your workforce.

Foreign operatives are using fake or stolen identities to gain employment at U.S. companies, collect paychecks, and exploit access to sensitive systems and data. Backed by elaborate support networks, these individuals often hold multiple full-time positions simultaneously, use artificial intelligence (AI) to complete their work and funnel their salaries to hostile foreign governments.

This is not a hypothetical risk – it is happening now. The U.S. Department of Justice (DOJ), U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) and FBI have made countering this threat a top enforcement priority, and these schemes are estimated to generate $800 million annually for the North Korean (DPRK, or Democratic People’s Republic of Korea) regime. Since 2025, federal authorities have announced coordinated actions targeting laptop farms, identity theft and fraudulent websites, financial accounts and facilitator networks.

In July 2026, the U.S. Department of State and FBI, in coordination with 10 allied nations, issued a joint advisory, "Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers," to warn companies, online platforms and other organizations about the growing threat posed by North Korean information technology (IT) workers fraudulently obtaining remote employment using stolen or fabricated identities.

For companies, exposure extends beyond sanctions and cybersecurity. It is also a workforce governance issue spanning human resources (HR), recruiting, immigration compliance, contractor oversight, employee relations and recordkeeping obligations. This Holland & Knight alert explains how the scheme works, the legal risks it creates, and practical steps companies can take to protect themselves.

Overview of the Threat

North Korean IT worker schemes involve North Korean nationals and U.S.-based facilitators who use stolen or synthetic identities – often augmented by AI, deepfake technology and fabricated professional histories – to obtain remote IT positions at U.S. companies. Threat intelligence groups have reported a 220 percent increase over the past 12 months in the number of companies infiltrated by these actors, leveraging generative AI to increase the volume and sophistication of applications.

These operatives rely on a network of domestic and international facilitators. U.S.-based accomplices may operate "laptop farms," receiving employer-issued devices and enabling remote desktop connections so that the operative appears to be working from within the U.S. Facilitators may also create accounts on job search platforms, establish front companies to bolster the workers' credibility, attend virtual interviews on their behalf, supply altered documents, participate in or coach interviews, configure remote access tools and set up financial accounts to launder the proceeds.

Once hired, these workers perform their assigned duties while their salaries are funneled back to the North Korean government. Because they obtain legitimate credentials and system access, they function as insider threats capable of theft of sensitive data, including IP, trade secrets, personal identifying information (PII), controlled information or financial information, as well as installing backdoors for future cyberattacks and, in some cases, extorting employers after termination.

For employers, the challenge is especially acute: Companies must move quickly to prevent unauthorized access, data theft and sanctions exposure while ensuring that hiring, screening, investigation and termination decisions remain grounded in objective, job-related indicators rather than assumptions about national origin, citizenship, ethnicity or immigration status.

Labor and Employment Risks

Companies understandably want to implement robust screening processes to identify these threat actors early and act swiftly and lawfully when concerns arise about a current employee. Although North Korean IT workers share certain profiles and common tactics, employers must be careful not to implement overly aggressive screening mechanisms or investigation protocols that could be perceived as or actually constitute unlawful discrimination or violate federal immigration laws.

Title VII of the Civil Rights Act of 1964 (Title VII) prohibits employment decisions based on national origin, race and related protected characteristics, while the antidiscrimination provisions of the Immigration and Nationality Act (INA) prohibit citizenship status discrimination and unfair documentary practices in the Form I-9 and E-Verify process. State and local laws may impose additional protections or procedural requirements.

Screening protocols should therefore be applied uniformly across similarly situated roles tied to legitimate security and access-risk considerations and documented using objective indicators such as inconsistent identity data, unexplained location anomalies, suspicious device-shipping requests or unauthorized remote access tools. The following section outlines the core legal guardrails that employers must navigate when addressing this threat.

The Inbound Risk: Hiring and Screening

Hiring and Onboarding Vulnerabilities. North Korean IT workers exploit weaknesses in remote hiring processes by using AI-generated resumes, deepfake video during interviews and stolen identities to pass initial screening. Accomplices may appear on camera during a video interview while the North Korean IT worker redirects substantive discussion to a phone, chat or other side channel under the guise of technical difficulties. Other red flags may include a reluctance to appear on video for follow-up calls, sudden requests to communicate on alternative platforms, mismatches between stated location and detected IP addresses, requests to ship company-issued equipment to a different address shortly after hire, and inconsistencies in name spelling, education or employment history across candidate profiles.

I-9 and Employment Eligibility Verification. These schemes can undermine the Form I-9 process when operatives use fraudulent identity documents or domestic facilitators to satisfy in-person or remote verification steps. Employers should not respond by demanding more documents than required, imposing "U.S. citizen only" requirements without a legal basis or reverifying workers when not required. Instead, companies may consider the current Form I-9, follow E-Verify and any remote examination procedures authorized by the U.S. Department of Homeland Security where applicable, accept facially valid documentation as required and route suspected fraud to trained HR, immigration, employment and cybersecurity counsel for a coordinated review.

Detecting Fraud Without Discriminating. Hiring teams face two competing legal risks: 1) failing to detect fraudulent applicants and 2) overcorrecting in ways that trigger discrimination claims based on national origin, race, ethnicity or citizenship status under Title VII or the INA. Employers should consider screening procedures designed to test for fraud indicators that apply uniformly to all applicants rather than singling out applicants by perceived national origin, accent or surname. Hiring managers, recruiters and HR personnel may benefit from periodic training on DPRK threat indicators and prohibited practices so that fraud-prevention enhancements do not disproportionately burden applicants based on protected characteristics.

Responding When You Suspect a Current Worker May Be a North Korean IT Worker

Identifying a suspected North Korean IT worker is a time-sensitive challenge that requires careful coordination across legal, HR, IT and security functions and implicates multiple – and at times competing – legal obligations. Counsel may lead or supervise the response so that employment decisions, forensic steps, sanctions analysis and communications remain aligned. The goal is to contain risk without converting a security investigation into a discrimination, retaliation, defamation, wage payment or wrongful-termination claim.

Balancing Speed and Antidiscrimination Risk. As mentioned above, companies face competing legal risks to act against a fraudulent applicant without triggering other types of claims. Internal investigations and adverse employment decisions should be guided by objective, articulable indicators of fraud or misconduct – for example, inconsistent location data, mismatched identity documents, suspicious remote-access tools, anomalous login activity, payroll-routing irregularities or refusal to appear on camera – rather than assumptions tied to nationality, accent, surname or perceived ethnicity. Investigations that disproportionately target employees based on protected characteristics can give rise to claims under Title VII and 8 U.S.C. § 1324b, even where the underlying fraud concern is genuine. To minimize this risk, employers should 1) conduct the investigation at the direction of legal counsel, 2) coordinate cyber, HR and legal workstreams in parallel, 3) apply consistent investigative protocols across similarly situated workers, 4) document the factual basis for each step and 5) refrain from drawing adverse inferences from protected characteristics. Where conduct rises to the level of suspected fraud, falsification of identity or unauthorized access, employers generally have a legitimate, nondiscriminatory basis to suspend pending investigation or terminate consistently with at-will employment principles and applicable policies and agreements.

Evidence Preservation, Access Control and Employment Status. Once a company has an articulable basis for concern, the incident-response team may wish to preserve evidence, restrict access proportionately and determine employment status while the investigation proceeds. IT and security teams may need to disable or limit system access, credentials, virtual private network (VPN) and single sign-on (SSO) tokens and should preserve forensic logs to support any future investigation, sanctions analysis, voluntary disclosure or litigation. In parallel, HR and employment counsel can determine whether the separation complies with contractual, statutory and policy-based requirements – including notice and final-wage timing under applicable state law – while remaining mindful that U.S. sanctions law generally prohibits payments to a DPRK-affiliated individual. Because OFAC sanctions violations carry strict liability, engaging with North Korean workers can result in penalties, even when companies are unaware, they have transacted with a sanctioned person or entity. Employers may wish to consult counsel before post-discovery payments and consider blocking or escrowing amounts payable to a sanctioned person. Companies may also wish to anticipate that fraudulent workers may exploit wage-payment statutes or frame extortion demands as severance. To manage these tradeoffs, companies may consider folding DPRK-specific procedures into existing insider-threat and incident-response playbooks – developed comprehensively with legal, HR, IT and security teams – covering containment, evidence preservation, termination, sanctions screening and reporting.

Liability Under Data Protection Frameworks. Unauthorized access to personal data and sensitive business information by a DPRK operative can trigger obligations under federal and state data privacy and security laws, as well as contractual data protection commitments. The resulting breaches can give rise to regulatory enforcement, private litigation and reputational harm. Companies may wish to assess breach notification obligations promptly upon discovering unauthorized access.

Re-Infiltration After Termination: The Persistence Problem

Persistence. One of the most distinctive features of the DPRK fraudulent worker threat is persistence. Once a company identifies and terminates a suspected operative, it should expect that these actors will attempt to re-infiltrate the organization. Former DPRK workers possess detailed knowledge of the company's systems, hiring processes, team structures and technical environment, and they may reapply under new identities with credentials and experience tailor-made for available roles based on their insider knowledge. HR, IT security and legal may consider heightened scrutiny to applications for roles recently vacated by suspected DPRK workers and monitor for repeated device-shipping addresses, banking information, contact data, portfolio materials or technical profiles associated with prior incidents. Because these monitoring activities can implicate employee and applicant privacy obligations and antidiscrimination rules, the monitoring program may be designed by cyber, privacy and employment counsel jointly, applied consistently across applicants and grounded in objective indicators.

Third-Party and Vendor Risk. Companies that outsource IT work to third-party vendors face additional exposure because they are removed from the direct hiring process. DPRK operatives with fraudulent identities can exploit gaps in background checks and third-party risk management programs, making robust vendor due diligence and contractual security commitments essential.

Considerations for Companies

The North Korean IT worker threat is a cross-functional compliance priority requiring coordination among HR, IT, legal and security teams. Drawing on the legal and operational principles discussed above, companies may also consider some practical steps:

• Apply consistent, role-based identity verification, live interviews, reference checks and technical validation steps for all remote IT and sensitive positions, including live, on-camera interviews with a government-issued photo ID, "soft" questions about claimed location and work history that are difficult to script and reference checks using independently sourced contact information.
• Train HR, recruiters, hiring managers, procurement, finance and security teams on DPRK threat indicators, red flags, lawful screening limits, Form I-9/E-Verify antidiscrimination rules (including avoiding overdocumentation, document-specific demands and premature reverification), sanctions escalation and internal reporting channels.
• Review and update vendor due diligence procedures, particularly with staffing agencies.
• Strengthen remote-access security controls, including geolocation tracking, mandatory multifactor authentication and restrictions on remote desktops, and monitor for unauthorized remote-access software, anomalous login activity, improbable travel patterns and simultaneous multi-device usage suggesting proxy hosting.
• Restrict corporate laptop delivery to verified shipping addresses that require photo identification or in-person pick-up with a team member, and condition remote employment on a stated, verifiable U.S. work location with a uniform confirmation protocol such as IP geolocation, multifactor authentication logs and tax-withholding documentation.
• Implement sanctions screening that may help detect the use of aliases, questionable organizational structures and suspicious payment destinations, and consider escalation protocols for voluntary self-disclosure to OFAC, DOJ or the FBI if North Korean IT worker activity is identified.
• Document legitimate, nondiscriminatory reasons for screening, investigation, suspension or termination decisions, and apply escalation criteria consistently across similarly situated workers.
• Conduct a risk assessment to identify the company's specific vulnerabilities to fraudulent workers across hiring, IT access and vendor channels.

Conclusion

The North Korean IT worker threat is active, adaptive and increasingly intertwined with ordinary workforce processes. Companies that rely on remote IT talent should expect heightened scrutiny from regulators and law enforcement. The most effective response is neither purely technical nor purely employment-focused – it is an integrated program that aligns lawful hiring controls, antidiscrimination safeguards, incident response, sanctions compliance, evidence preservation and clear escalation protocols.

Organizations that develop open communication streams and work cross-functionally will be best positioned to protect against these schemes. Contact the authors to discuss how counsel can support proactive controls and incident response.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.