North Korean remote worker scheme

Full article adapted from Wikipedia revision 1376342030 by Wikipedia contributors. Text is available under CC BY-SA 4.0. Formatting has been adapted; article text and references are retained. Snapshot imported 2026-09-25.

<tbody> </tbody>

North Korean remote worker scheme

Founded	c. 2014
Founding location	North Korea
Years active	2014–present
Territory	Global (primarily targeting US and European companies)
Ethnicity	Primarily North Korean
Membership	Estimated 8,400 cyber operatives (2024)
Criminal activities	Identity theft, Wire fraud, Money laundering, Cyber espionage

a laptop farm in Litchfield Park, Arizona, US, photographed by the FBI in 2023

North Korean operatives have posed as remote workers in Western companies under stolen or fabricated identities, primarily targeting information technology and technical roles. They generate revenue for the North Korean government, particularly to fund its weapons programs.

Operations

The operation emerged as part of North Korea's broader cybercrime strategy under Kim Jong Un, who made information technology a national priority after assuming power in 2011. The COVID-19 pandemic significantly expanded remote work opportunities, which North Korean intelligence services exploited to scale up their operations.

According to South Korea's National Intelligence Service, the number of people working in North Korea's cyber divisions grew from 6,800 in 2022 to 8,400 in 2024, including IT worker infiltrators, cryptocurrency thieves, and military hackers.

The operations are run by North Korea's Department 53. It is behind front companies including Korea Osong Shipping Co. and Chonsurim Trading Corporation, that sent IT workers to Laos.

Recruitment and training

North Korean intelligence services, including the Reconnaissance General Bureau, recruit top graduates from prestigious institutions such as Kim Chaek University of Technology and the University of Sciences in Pyongsong. These operatives are trained in hacking techniques, foreign languages, and are promised higher wages and internet access as incentives.

Methodology

The scheme typically follows a standardized process:

1. Operatives create fake profiles using stolen personal information, including Social Security numbers, addresses and other credentials from real people.
2. Using platforms like LinkedIn and freelance sites like Upwork, operatives apply for high-paying, fully remote positions, with a focus on IT roles such as software engineering, web design, and full-stack development, though the scheme has expanded to other technical and some non-technical roles.
3. Operatives use artificial intelligence tools, including deepfake technology, to pass video interviews and coding assessments while impersonating their stolen identities.
4. After being hired, operatives request that company laptops be sent to addresses controlled by facilitators outside North Korea, who maintain "laptop farms" containing dozens of devices that can be controlled remotely.

Income

According to US government estimates, a typical team of North Korean IT workers can earn up to $3 million annually. Individual workers can earn an average of $300,000 per year, with the funds being funneled directly to North Korea's government and weapons programs. Some operatives work multiple jobs simultaneously to maximize earnings.

Notable cases

Christina Chapman case

In 2025, Christina Marie Chapman, a 44-year-old American citizen from Arizona, pleaded guilty to federal charges related to operating a laptop farm that facilitated North Korean operatives for three years. Chapman's operation involved over 300 American companies and generated more than $17 million for the North Korean government. She was sentenced to 8 years in federal prison.

KnowBe4 incident

In July 2024, KnowBe4, a US cybersecurity training company, discovered that a new employee identified as "Kyle" was actually a North Korean operative who had passed background checks and ID verification.

Nisos incident

In June 2025, Nisos, a US security company, determined that a job applicant known as "Jo" was a North Korean operative. The company ran an operation to gain insight into the cell's full operations.

Zhenxing and Kejia Wang case

In June 2025, U.S. federal prosecutors in Boston charged New Jersey residents Zhenxing “Danny” Wang and Kejia “Tony” Wang for their roles in a scheme that allegedly helped North Korean information technology workers obtain remote employment with more than 100 U.S. companies using stolen identities. According to prosecutors, the scheme compromised the identities of more than 80 Americans, generated more than $5 million in revenue for the North Korean government, and caused U.S. companies at least $3 million in losses and remediation costs. The Wangs and other U.S. facilitators allegedly operated “laptop farms,” hosting company-issued computers at residences and connecting them to remote-access devices so that overseas workers could appear to be working from the United States. They also created shell companies and financial accounts to facilitate the scheme.

Zhenxing Wang was arrested in New Jersey and indicted alongside eight overseas co-conspirators, while Kejia Wang was charged separately and agreed to plead guilty. Kejia Wang pleaded guilty in September 2025 to conspiracy to commit wire fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft. Zhenxing Wang pleaded guilty in January 2026 to conspiracy to commit mail and wire fraud and conspiracy to commit money laundering. In April 2026, Kejia Wang was sentenced to nine years in prison and Zhenxing Wang to 92 months; both were also ordered to forfeit $600,000, with Zhenxing Wang ordered to pay an additional $200,000 in restitution.

Impact

According to Mandiant (now part of Google Cloud), nearly every Fortune 500 company chief information security officer interviewed about the issue has admitted to hiring at least one North Korean IT worker. SentinelOne, a cybersecurity firm, reported receiving approximately 1,000 job applications linked to North Korean operatives.

North Korean operatives generally target software engineer, front-end developer and full-stack developer jobs, though the scheme extends to roles beyond traditional IT.

The impact of these schemes includes data theft, as operatives often steal sensitive company data and intellectual property; the installation of malware for future access or ransomware attacks; and compliance violations, since unknowingly employing North Korean operatives violates international sanctions.

While initially focused on US companies, the scheme has expanded globally. CrowdStrike reports tracking similar operations in the United Kingdom, Poland, Romania and other European countries, as well as organizations in South Asian countries.

US government response

The FBI, State Department, and Treasury Department have issued joint advisories warning companies about the threat, and initiated multiple prosecutions.

In December 2024, the Justice Department indicted 14 North Koreans for generating at least $88 million over six years.

The Department of Justice announced indictments in January 2025 against two Americans for operating a six-year scheme that placed North Korean operatives in over 60 US companies, generating more than $800,000 in revenue.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) announced sanctions in January 2025 against two individuals and four entities involved in North Korea's illicit remote IT worker schemes that generate revenue for the country's weapons programs. The sanctioned entities include two front companies (Korea Osong Shipping Co. and Chonsurim Trading Corporation) that sent IT workers to Laos, Chinese company Liaoning China Trade Industry Co. for supplying technological equipment, and individuals Jong In Chol and Son Kyong Sik who ran the front operations.

See also

• Illicit activities of North Korea
• Lazarus Group
• Remote work
• Identity theft
• Sanctions against North Korea