FBI Says North Korean IT Workers Are Expanding Facilitator Networks and Calls for Identity-in-Depth Defenses

LONDON - The FBI said on Oct. 13, 2026 that North Korean state-controlled remote IT workers are hiring a wider range of U.S. and foreign facilitators to keep fraudulently obtained jobs after private-sector detections and law enforcement disruptions improved, and that companies can no longer rely on a single hiring indicator to find them. In Public Service Announcement I-101326-PSA, published by the Internet Crime Complaint Center, the bureau calls for an "identity in depth" approach: layered access controls and detections across the employment lifecycle that treat weak signals as compounding evidence rather than as ban-list rules. The same day, the Justice Department announced coordinated actions against the schemes, including arrests, an indictment tied to more than 70 U.S. employers, and seizures of about 187 devices from laptop farms in Texas.

The PSA updates earlier FBI guidance and says the workers, whom it labels ITWs, use stolen identities, extort victims, and have recently made threats of physical violence to demand payments. According to the advisory, North Korean government entities receive an estimated 85 to 90 percent of the revenue the workers generate, and the largest operator is likely the Munitions Industry Department under the Central Committee of the Workers' Party of Korea. Dozens of ITW teams, typically about a dozen military-aged men under group leaders, are paying Americans and others to keep employer-issued devices online from residences, lend social media or professional networking accounts with years of legitimate history, appear on camera for interviews, ship packages, complete fingerprint or urinalysis requests, and otherwise hide the workers' involvement. The bureau says the workers have shifted toward more laptop farms with fewer machines at each site to avoid single points of failure, and that some teams now subcontract entire jobs to freelancers in South Asia or West Africa after the North Korean hire is in place.

For SOC and corporate security teams, the detection value is in the behaviors the FBI lists for employer-issued endpoints. The PSA says ITWs continue to use remote desktop and remote monitoring and management software, including AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop Streamer. They also use external Keyboard Video Mouse over IP hardware such as TinyPilot, PiKVM and GL.iNet devices, and sometimes a second laptop to control the employer machine. The bureau says workers frequently install applications outside their job role, including OBS Studio with a VDO.Ninja plugin to establish remote connections and Homebrew for package management, and that they almost always exfiltrate data because most are required to record their screens for daily work tracking on a device that can sit several hops away from the employer laptop. High rotation of bank accounts, street addresses and social media identifiers is another recurring pattern after account bans.

The advisory warns that forging verification documents for stolen identities remains common, and that relying solely on name ban lists is unreliable, can block qualified applicants and can punish identity-theft victims. It recommends raising friction with E-Verify, U.S. passport or multi-document checks, and live verification, and it stresses cross-functional review among information technology, human resources, security and management. Aggressive controls, the FBI notes, carry an unusually high risk of false positives against legitimate remote employees, which is why "identity in depth" favors probabilistic stacks of moderate signals over brittle single rules. The PSA also says ITWs are trying to use identities or facilitators who can reach jobs that require U.S. government clearances or unique skills, including roles at cleared defense contractors, and that they have sought active-duty U.S. military members to host laptops.

Escalation after detection is part of the picture. The FBI says it has observed death threats against former managers and their families after terminations, threats to leak or publicly post proprietary data unless lump-sum payments are made, and U.S.-based facilitators paid to appear in person at companies or at laptop-farm residences for intimidation. The same-day Justice Department announcement said Operation Lonestar Roundup searched more than 40 Texas residences between Sept. 21 and Sept. 25, seized about 187 laptops and KVM devices, and that a Northern District of Ohio indictment and two arrests involve a multi-year scheme that generated more than $3 million across more than 70 U.S. company employers in health care, communications, cyber support, retail and manufacturing. Assistant Director Brett Leatherman of the FBI's Cyber Division said in that announcement that North Korea continues to deploy remote IT workers with stolen identities and that the PSA's mitigation guidance is meant to help U.S. companies counter the evolving facilitator model. Organizations that believe they have been approached or infiltrated are told to contact their local FBI field office and file an IC3 complaint with street addresses tied to devices, personal identifiers, images or screenshots, and any evidence of facilitators.