# The Job Candidate Who Isn't There: How to Spot North Korea's IT Worker Infiltration
The résumé looks impeccable. Six years of full-stack experience, strong GitHub history, references that check out. The video interview goes fine — a little choppy, maybe, but remote calls are always a little choppy. The candidate gets the offer. Their laptop ships to a forwarding address in New Jersey. Somewhere in Shenyang, a DPRK operative logs into your corporate network for the first time.
This is not a theoretical attack surface. It is a revenue stream. Hundreds of North Korean IT workers are currently embedded inside Western companies — sometimes dozens at a single employer simultaneously — funneling salaries directly into Pyongyang's weapons programs. The FBI, CISA, and the Department of State have all issued warnings. The Department of Justice has charged facilitators and seized cryptocurrency. And the scheme keeps running, because the underlying conditions that made it possible — normalized remote hiring, distributed teams, overworked HR departments — haven't changed.
What has changed is how good the operatives are getting. Researchers tracking these campaigns say the quality of fabricated identities has improved substantially over the past two years. The question is whether defenders are improving faster.
## A Revenue Operation, Not Espionage — Until It Is
Understanding why this is hard to stop requires understanding what it actually is. North Korean IT worker infiltration is primarily a financial operation. A single operative earning $80,000 a year at a tech company — after fees to the network of facilitators running the logistics — can clear enough to matter at scale. When you multiply that across hundreds of placed workers, you're looking at a significant, durable funding mechanism.
The espionage angle is secondary, but it's real. Once access is established, operatives can exfiltrate code, credentials, or proprietary data. In at least some documented cases, workers have pivoted to extortion after being caught — threatening to leak data unless paid. The attack model is flexible: start as a legitimate (fraudulent) employee, then escalate based on what you find or what happens when detection looks imminent.
This dual-use model — funding operation that can become intelligence operation on demand — makes it more dangerous than a pure espionage campaign. Pure espionage gets caught and ends. An operation built around ongoing employment revenue has strong incentive to stay quiet and stay embedded.
## The Red Flags That Hold Up
Researchers have catalogued the tells. Not all of them are obvious, and some require deliberate process changes to catch.
During hiring:
After hire:
The deepfake problem: Live video no longer guarantees authenticity. Researchers have documented cases where operatives used real-time face-swapping during video calls. Tells include unnatural blinking, hair that behaves oddly at the edges, and lighting that doesn't match the supposed environment. Requiring candidates to make unexpected, natural movements — turning their head quickly, holding up a specific object — can expose real-time rendering artifacts.
## The Organizational Gap Defenders Keep Falling Into
Here's what most coverage of this issue misses: this is a hiring problem that companies are treating as a network security problem, and that mismatch is how operatives stay embedded.
Security teams are being asked to detect the anomalies after a compromised hire is already inside the perimeter. That's playing on hard mode. The controls that actually work are earlier in the pipeline — at recruitment. But recruiting teams aren't typically reporting to CISOs. The incentives are misaligned. Recruiters are measured on time-to-fill and offer acceptance rates, not on identity verification rigor.
Companies that have successfully interrupted these placements tend to share a few things: they require video verification with live identity document checks (not just a self-reported ID scan), they cross-reference shipping addresses against stated locations as a matter of policy, and they've established explicit collaboration between HR and security on remote hire onboarding.
KnowBe4's public disclosure of their own near-miss — where they caught a North Korean operative within days of hire because of anomalous endpoint behavior — was valuable precisely because it showed the detection was possible, but came embarrassingly late in the process. The lesson isn't "your EDR will save you." The lesson is that a competent HR process shouldn't let it get that far.
---
## HackWire Analysis
The North Korean IT worker scheme is now mature enough that we should stop treating it as a novel attack and start treating it as a category — one with documented TTPs, known infrastructure patterns, and a growing body of prosecutorial evidence.
What makes this moment interesting is the inflection point on both sides. Offensive: the use of AI-generated identities and real-time deepfakes means the visual verification controls that companies started deploying two years ago are already degrading. Defensive: there's now enough public case history that organizations have no excuse for not having explicit policies around remote hire identity verification.
The pattern this fits is broader than DPRK. Nation-state actors have increasingly blurred the line between traditional espionage and economic activity — using cyber operations to generate revenue, fund operations, and create deniable infrastructure. North Korea is the most aggressive practitioner of this model, but it's not the only one watching the results.
What most coverage is missing: the facilitator network is the actual attack surface. Operatives in Pyongyang need Americans or other Westerners to receive hardware, forward payments, and provide domestic cover. DOJ has charged several of these facilitators. Disrupting the logistics layer — the laptop farms, the money mule networks, the forwarding addresses — is probably more durable than trying to catch individual operatives at the résumé stage. That's a law enforcement problem, not a corporate security problem, but it's where the leverage is.
For defenders right now: the practical controls are the boring ones. Live identity verification with movement prompts. Equipment shipped only to addresses verified against a government ID. Clear escalation paths when recruiting flags a remote candidate anomaly. And explicit acknowledgment that your security team needs a seat at the table during remote onboarding, not just after an incident.
This problem is going to get harder before it gets easier.
— HackWire Editorial
---
## Related Coverage