This morning brought unsettling news that speaks to one of the most sophisticated employment fraud schemes I’ve encountered in recent memory. CrowdStrike has identified over 320 incidents over the past 12 months, up by 220% from the year earlier, in which North Koreans gained fraudulent employment at Western companies working remotely as developers (North Korean spies posing as remote workers have infiltrated hundreds of companies, says CrowdStrike).
What fascinates me about this story isn’t merely the scale of it. It’s the methodical precision with which North Korea has essentially weaponised remote work culture itself.
The Mechanics of Modern Deception 🎭
The scheme operates with remarkable sophistication. Since 2024, Microsoft Threat Intelligence has observed remote IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the North Korean government.(Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations).
But here’s what struck me most: Between 2020 and 2022, the US government found that over 300 US companies in multiple industries, including several Fortune 500 companies, had unknowingly employed these workers. This isn’t a case of fly-by-night operations falling victim to simple scams. These are some of America’s most sophisticated companies.
The playbook is disturbingly effective. North Korean operatives create entirely fabricated personas, complete with services that generate fraudulent identities, complete with seemingly legitimate documentation, to fabricate their personas. They then create email accounts and social media pages they use to apply for jobs, often indirectly through staffing or contracting companies.
The AI Amplifier 🤖
What’s particularly concerning is how artificial intelligence has supercharged this scheme. CrowdStrike’s investigations revealed North Korea’s tech workers, an adversary CrowdStrike dubs “Famous Chollima,” used AI to scale every aspect of the operation. The North Koreans have used generative AI to help them forge thousands of synthetic identities, alter photos, and build tech tools to research jobs and track and manage their applications (Arizona woman in North Korean IT workers scheme sentenced to 8.5 years for helping to trick Fortune 500 companies out of millions).
The sophistication extends to the interviews themselves. AI has emboldened the North Korean scheme, allowing the IT workers to develop scripts so they can hold down as many as six or seven jobs at a time, disguise their appearance, and even alter their voices so they don’t have an accent—or so they sound like a woman instead of a man (Dozens of Fortune 100 companies have unwittingly hired North Korean IT workers, according to report).
The Financial Engine Behind Nuclear Ambitions 💰
The numbers behind this operation are staggering. The DPRK government withholds up to 90 percent of the wages earned by these overseas workers, thereby generating annual revenues of hundreds of millions of dollars for the Kim regime’s weapons programs to include weapons of mass destruction (WMD) and ballistic missile programs (Treasury Sanctions Clandestine IT Worker Network Funding the DPRK’s Weapons Programs).
One case study illustrates the scale perfectly. The scheme Chapman involved herself in claimed about $17.1 million in salaries from 309 U.S. businesses, paid to North Koreans posing as American IT workers. Nearly 70 Americans had their identities stolen, authorities said (Chinese companies are secretly powering North Korea’s global IT workers scheme). This was just one facilitator’s operation.
The Corporate Impact 🏢
The corporate impact extends far beyond the financial. “There are hundreds of Fortune 500 organizations that have hired these North Korean IT workers,” Mandiant Consulting CTO Charles Carmakal said. “Literally every Fortune 500 company has at least dozens, if not hundreds, of applications for North Korean IT workers.”
Even major brands haven’t escaped. Nike was one of the victims and wrote a letter identifying themselves as one of the companies that unwittingly hired a North Korean IT worker and paid the employee $70,000.
Perhaps most troubling is this admission from Mandiant: Nearly every Fortune 500 company chief information security officer interviewed about the issue has admitted to hiring at least one North Korean IT worker (North Korean remote worker infiltration scheme – Wikipedia).
The Intelligence Dimension 🕵️
This isn’t simply about illicit revenue generation. IT workers employed under this scheme also gained access to sensitive employer data and source code, including International Traffic in Arms Regulations (ITAR) data from a California-based defense contractor that develops artificial intelligence-powered equipment and technologies. Specifically, between on or about Jan. 19, 2024, and on or about April 2, 2024, an overseas co-conspirator remotely accessed without authorization the company’s laptop and computer files containing technical data and other information. The stolen data included information marked as being controlled under the ITAR (Office of Public Affairs).
Detection Strategies Emerge 🔍
The response from the private sector has been creative, if unconventional. “Say something negative about Kim Jong Un,” Leggio tells potential job candidates, referring to the third-generation authoritarian Supreme Leader of North Korea. Through research, Leggio learned insulting the DPRK’s Supreme Leader is forbidden, and North Korean citizens could face serious punishment for showing anything less than reverence. “The first time I ever did it, the person started freaking out and cursing,” said Leggio. The job seeker subsequently blocked Leggio across all social media platforms (North Korean IT worker infiltrations exploded 220% over the past 12 months, with GenAI weaponized at every stage of the hiring process).
More formal detection methods are also emerging. Use “soft” interview questions to ask applicants for specific details about their location or education background. North Korean IT workers often claim to have attended non-US educational institutions (Internet Crime Complaint Center (IC3)).
The Broader Implications 🌐
What makes this particularly troubling is the trajectory. CrowdStrike predicted Famous Chollima will continue its campaigns in 2025 given the financial success it’s seen and limited impact from federal prosecutions and government indictments last year. Experts predict the scope and scale will expand in 2025, moving across Europe and Asia with well-honed social engineering tactics paired with more aggressive job hunting at European defense and government companies.
The scheme represents something unprecedented: a nation-state essentially industrialising employment fraud to circumvent international sanctions while simultaneously conducting espionage operations. “Stop looking at North Korea’s cyber program as a government program like the other major state programs and liken them to a single-family mafia organization and the lines begin to unblur,” states a new report from cybersecurity firm. For context, the DPRK’s crime syndicate involves a vast global scheme in which trained technologists from North Korea have been deployed by the thousands. The workers have impersonated or stolen American identities to illegally obtain remote jobs in IT. They send their salaries back home to North Korea to fund Kim’s nuclear weapons and ballistic missile ambitions (Arizona woman sentenced for $17M information technology worker fraud scheme that generated revenue for North Korea).
The human cost deserves attention as well. Prosecutors said human cost is unmistakable and the Americans who had their identities stolen in the scheme have faced severe consequences. Fake tax liabilities were created in their names, and they’ve faced ongoing monitoring from the IRS and Social Security Administration. One victim was denied unemployment because an IT worker was using their Social Security number.
This story illustrates how traditional employment verification systems, designed for a different era, have become vulnerabilities in our interconnected digital economy. As remote work becomes increasingly normalised, the challenge of verifying identity and intent becomes exponentially more complex.
The North Korean IT worker scheme isn’t just a cybersecurity issue or an employment fraud concern. It’s a window into how nation-states are adapting to exploit the very technologies and work patterns that have enabled our modern economy. The implications extend far beyond corporate America into questions about how we verify identity, conduct business, and maintain security in an increasingly remote world.
