Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security

The week

On July 23, 2024, the security awareness company KnowBe4 published an account of how it had hired a remote software engineer who turned out to be a North Korean IT worker. The person used a stolen US identity and a photo altered with AI tools. The candidate passed background checks, reference checks and several video interviews. On July 15, the day the company-issued Mac arrived, it began loading malware. KnowBe4’s security operations team detected the activity and contained the device. The company said no data was accessed or lost. The disclosure followed repeated FBI and State Department warnings about North Korean IT workers taking remote jobs to earn revenue for the regime. In May 2024 the Justice Department had charged an Arizona woman with running a laptop farm that hosted company devices for such workers.

Earlier in this series, the April 2022 TraderTraitor advisory showed North Korean operators using fake job offers to reach employees at crypto firms. The KnowBe4 case runs the other way. Here the operator is the candidate, and the employer delivers credentials and a laptop on day one. The scheme does not need to defeat any single control. It needs to pass a chain of hand-offs, each owned by a different team that sees only its own step. Recruiting runs the interviews. HR and a screening vendor run the background check. IT ships the device. Security and the hiring manager watch the work. There are four hand-offs: interview to offer, offer to onboarding, onboarding to device, and device to daily work. At each one, the question is whether the identity verified at the previous step is the identity now in front of the organization.

Interview to offer

A background check confirms that a name, Social Security number and history belong to a real person with a clean record. It does not confirm that the person on the video call is that person. Federal advisories describe schemes built on stolen or borrowed US identities, edited photos and résumés copied from real profiles. Some use proxies who sit interviews on the worker’s behalf.

Controls at this hand-off compare a government document to a live person and bind the result to the candidate record. Interview teams should look for patterns that are weak on their own and strong together. Examples are a phone number on a VoIP service, a work history no reachable colleague can confirm, and reluctance to turn on a camera. Recruiters need a route to escalate a doubt to security without being forced to make an accusation. For roles with privileged access, one in-person step before the offer raises the cost of impersonation more than any software check.

Offer to onboarding

The person who completes onboarding is not always the person who interviewed. Proxies can pass interviews and hand over the job, or the reverse. This hand-off is where HR paperwork, payroll setup and identity proofing meet, and it is the cheapest point to re-verify. Employment eligibility checks do not close the gap on their own. Since August 2023, employers enrolled in E-Verify may examine Form I-9 documents remotely over live video. That shows a document looks genuine. It says little about whether a stolen document belongs to the person holding it up.

A live identity check at onboarding, by the same method used before the offer, closes the gap. Payroll data is a strong signal. Requests to pay into accounts at unfamiliar payment services, frequent changes of bank details and tax addresses that differ from the verified home address all deserve a second look. Employers should also remember the sanctions exposure. Paying a worker who is in fact acting for North Korea can create liability under US sanctions law even when the employer did not know. That makes this a question for the compliance function and counsel as well as HR.

Onboarding to device

The laptop farm model depends on employers shipping a device to a US address. A facilitator keeps it powered and connected so that the worker can control it remotely from abroad. Device logistics are therefore an identity control, though they rarely sit with anyone who thinks about identity.

Practical measures are simple. Ship only to the address verified during proofing. Flag a change of shipping address shortly before or after the start date. Require in-person pickup for privileged roles where feasible. Once the device is live, endpoint and network tools can show the warning signs. Look for remote access software the organization did not install, connections routed through commercial VPNs, and a machine that is always on with keyboard activity that does not match a normal workday. The data usually exists already. What is missing is a rule that tells someone to look for it during a new hire’s first weeks.

Device to daily work

KnowBe4 caught its hire because the security team saw malware on a new workstation within hours. Most schemes are quieter. The worker does the job, often adequately, while the salary funds the regime. Detection then depends on the manager and on access design.

Access can grow with tenure, so a new engineer cannot reach production systems or code repositories on day one. Monitoring can be more sensitive in the first weeks, under a policy staff know about. Managers can be told which patterns to raise: refusal to appear on camera, odd working hours relative to the claimed location, or sudden requests for broader access. Employment and privacy law shape what monitoring is permitted, so counsel should review the design.

Staffing firms and contractors sit outside all four hand-offs unless the contract pulls them in. Agreements should require the same identity proofing, device shipping rules and notice obligations the employer applies to its own hires. They should also give the client the right to audit them.

With hindsight

Government action intensified. The Justice Department charged more US-based facilitators from August 2024 and in December 2024 indicted 14 North Korean nationals over IT worker schemes. In January 2025 an FBI public service announcement warned that workers who were discovered had begun stealing source code and extorting employers. The Arizona facilitator charged in May 2024 pleaded guilty and in July 2025 was sentenced to 102 months in prison. Prosecutors said her scheme had touched more than 300 US companies. In June 2025 the Justice Department announced coordinated actions under its DPRK RevGen initiative, including searches of 29 known or suspected laptop farms across 16 states. The extortion turn changed the economics for employers. A fraudulent hire is no longer only a sanctions and payroll problem. It is a data breach waiting for a trigger, which makes the device and early-access controls described above the most urgent of the four.