A coalition of governments is sounding a fresh alarm about a scheme that has quietly become one of the more persistent threats facing companies that hire remote technical talent. The U.S. State Department and FBI, joined by counterparts in Japan, Canada, Germany, Australia, the United Kingdom, and South Korea, issued a joint advisory warning that North Korean IT workers are infiltrating private companies worldwide using stolen identities, forged documents, and networks of proxies.

The Goal: Funding a Weapons Program

Per the July 31, 2026 advisory, these operatives are securing freelance and full-time remote contracts under false identities specifically so they can funnel their earnings back to Pyongyang, helping bankroll the country’s nuclear weapons and ballistic missile programs in defiance of international sanctions. Beyond the financial angle, officials say the scheme creates a genuine insider-threat problem: workers embedded inside legitimate companies are positioned to exfiltrate data, steal cryptocurrency, or walk off with sensitive corporate information.

The Playbook

The methods described in the advisory are more elaborate than a simple fake resume. Operatives typically pose as foreign nationals on freelance, procurement, and hiring platforms, registering accounts with falsified nationality details and forged ID documents — frequently using photos supplied by third-party proxies based in entirely different countries.

Those proxies play an active role: sitting in for interviews, meeting in person when needed, or lending their own bank accounts so the actual worker never has to surface. Payment behavior is often a tell. Many of these applicants avoid standard direct deposit, instead requesting money transfer services or cryptocurrency, or routing wages through a third party’s account that later forwards the funds overseas after skimming a cut.

Authorities aren’t treating this as theoretical: eight people have already been sentenced in 2026 alone in connection with facilitation schemes that support this model.

The “Laptop Farm” Trick

One recurring technique described in the advisory involves what’s known as a laptop farm. A U.S.-based or other overseas facilitator receives a company-issued laptop and simply keeps it powered on and connected, allowing the actual North Korean worker to log in remotely from abroad while appearing, to the employer, to be working from a trusted location. Combined with VPNs and remote desktop software, operatives can convincingly mask the fact that they may actually be working out of North Korea, China, Russia, Southeast Asia, or Africa.

The advisory also notes that these workers increasingly lean on artificial intelligence to polish their fabricated profiles, generate more convincing written communication, and further obscure their real identities — narrowing the gap between a fake applicant and a legitimate one.

Legal Exposure for Employers

Companies that unknowingly hire these operatives aren’t just risking a bad hire. Paying a North Korean national for work can violate United Nations Security Council Resolution 2397 along with domestic sanctions laws in the U.S., Japan, South Korea, and elsewhere, exposing employers to real legal and financial penalties on top of any data or cryptocurrency losses tied to the infiltration itself.

Red Flags Employers Should Watch For

• Frequent changes to a candidate’s name, banking details, or payment-account information.
• Multiple applicant accounts sharing the same ID document or IP address.
• Identity images that appear forged, edited, or AI-generated.
• Refusal to enable video during interviews, or visible mismatches between a photo ID and the person on camera.
• Unusually long login sessions, below-market rate demands, or requests to be paid exclusively in cryptocurrency.
• Written communication riddled with translation inconsistencies despite a claimed native-level background.

What’s Being Recommended

The joint alert urges organizations to tighten identity verification during hiring, favor live, carefully scrutinized video interviews over text-only vetting, and deploy monitoring that flags anomalous account behavior after a worker is onboarded. Platform operators that host freelance and job-hiring marketplaces are being encouraged to strengthen their own account-monitoring tools and notify users when suspicious activity tied to this scheme is detected.

Anyone who suspects they’ve encountered this kind of scheme is advised to report it to their national authorities promptly. As the advisory makes clear, tighter identity checks, more rigorous video vetting, and closer attention to payment patterns aren’t just good hiring hygiene anymore — they’re now a frontline defense against inadvertently funding a sanctioned weapons program.