North Korean Sleeper Agents: Unmasking the Cyber Threat to US Tech

At a glance

• Emerging Threat: North Korean IT workers are getting hired by U.S. tech companies as remote staff.
• Cloaked Identities: They pose as skilled freelancers, using stolen or fake identities and the spread of remote work.
• International Impact: Their pay funds North Korea’s weapons programs, and their access puts company data at risk.
• Government Response: U.S. agencies are warning employers and asking allies to help shut the schemes down.

How North Korea gets inside U.S. companies

North Korea has found a quiet way into American tech firms: getting hired. Operatives pose as remote IT freelancers and land jobs at U.S. companies under false identities. The FBI says the money they earn goes to the regime’s weapons programs, in violation of U.S. and UN sanctions. Some also use their access to steal data. It reads like a spy thriller, and it is happening on ordinary hiring platforms.

The scheme works because it blends in. Hiring remote contractors became routine during the COVID-19 pandemic, and few companies ever meet those workers in person. That gives North Korean operatives plenty of cover.

How the deception works

The workers hide their real identities and present themselves as highly skilled IT professionals. They are skilled at using hiring platforms such as Upwork and LinkedIn, where they build profiles that look just like those of legitimate freelancers. U.S. authorities say they often rely on U.S.-based facilitators who run “laptop farms,” along with VPNs and remote-access tools, to hide where they really are.

They are hard to spot. Once inside, they look and work like any other skilled contractor, with access to internal systems and data that puts intellectual property and infrastructure at risk.

Why this is a global problem

The threat reaches beyond the United States. Experts warn that the access these workers gain could one day help enable attacks on critical systems such as finance or energy. Stolen information could also be used to undercut competitors or feed wider geopolitical tensions.

Officials have said that stopping the schemes requires cooperation between governments and companies across borders.

What companies can do

U.S. agencies have stepped up warnings and enforcement. Employers are urged to run stronger background checks, verify identities carefully, watch for unusual remote-access tools and logins, and, where possible, complete hiring and onboarding in person.

Sharing intelligence helps too.

Keep checking who you hire

The North Korean IT worker schemes show how far a determined state will go to raise money and gain access. They are a reminder that hiring is now part of security.

Remote work is not going away. Companies that verify who they are hiring, and keep checking after the job starts, will be much harder targets.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.