Human proxies challenge hiring checks in North Korean IT-worker schemes

NBC News has reported that DPRK-linked IT-worker teams are recruiting people in additional countries to appear in interviews or perform work under assumed identities, extending a fraud model built around false or stolen identities, remote operators and laptop farms.

The country-specific findings, published on 11 September, build on a multinational government alert issued on 31 July. That alert says North Korean IT workers are increasingly using third-party proxies to create online accounts, attend job interviews and make in-person contact as they pursue employment contracts.

The development matters because genuine people used as stand-ins can weaken checks intended to expose synthetic video, forged documents or a suspicious network location. Combined with AI-assisted identity concealment and overseas device facilitators, a human proxy can help an overseas operator appear to be a legitimate local applicant or worker.

The multinational alert states that DPRK IT workers use false identities, impersonate nationals of other countries and incorporate AI into efforts to conceal who they are. It also describes overseas facilitators supporting laptop farms, where company hardware can be kept somewhere other than the remote operator’s true location.

NBC News reported that the expanding recruitment activity involved people associated with Iran, Lebanon, Syria, South Africa and Saudi Arabia. Those geographical details do not appear in the multinational alert and remain dependent on NBC’s reporting and the security research it cited.

According to NBC, citing Flare research, DPRK IT teams recruited at least 14 Iranian nationals from 2024 onwards, and two received written offers from US employers. An offer does not establish that either person began working, received a company device or accessed an employer’s systems.

NBC also reported, citing Kudelski Security, that developers in Iran, Syria and South Africa agreed to work with North Korean teams that approached them through LinkedIn. The publication said some foreign recruits received cryptocurrency payments and were offered about $500 a month for part-time interview work under false identities. The underlying Flare and Kudelski Security material was not available to The Hack Academy for direct review, and it remains unclear whether participants knew they were supporting DPRK-linked teams, had been deceived or faced other circumstances.

Foreign assistance itself is not new to the campaign. In June 2025, the US Department of Justice announced enforcement actions involving allegations that people in the United States, China, the United Arab Emirates and Taiwan had helped DPRK actors obtain employment at more than 100 US companies. The FBI had also warned that US-based facilitators could receive company devices, enable unauthorised remote access and retain part of the resulting employment proceeds.

The newly reported development is an expansion in both geography and function. Rather than serving only as a payment intermediary or keeping a laptop at a local address, a proxy may create an account, appear on camera, establish in-person trust or perform outsourced development work. That division of labour can undermine controls that treat document fraud, manipulated video, payment anomalies and device location as separate problems.

This is an identity and insider-risk issue, not a disclosed software vulnerability. There is no CVE, affected product version or patch. A fraudulently placed employee or contractor may receive apparently legitimate access to source code, internal systems and sensitive information, while salary or contract payments can flow through facilitators and overseas financial channels. That creates fraud, sanctions and compliance exposure without requiring exploitation of a software flaw.

Government alerts have associated the broader DPRK IT-worker campaign with data exfiltration, sensitive-information theft and cryptocurrency theft. They have also linked the wider activity to malware and extortion. None of those outcomes has been established for the newly reported foreign recruits, however. No newly affected company is named in the available material, which does not show that the specific candidates described by NBC obtained production access or removed data.

The financial scale helps explain the sustained government attention. On 12 March 2026, the US Treasury sanctioned six individuals and two entities over what it described as DPRK government-orchestrated IT-worker schemes. Treasury estimated that the broader activity generated nearly $800 million in 2024 and supported North Korea’s weapons programmes. The figure is a government estimate for the wider operation, not an audited total or a measure of revenue from the newly reported proxy recruitment.

North Korea’s Foreign Ministry rejected the multinational allegations as politically motivated efforts to damage the country’s reputation, according to NBC. US and partner governments continue to characterise the broader operation as a DPRK government-orchestrated revenue scheme involving North Korean IT workers and overseas facilitators. None of the reviewed sources assigns the new third-country recruitment to a named DPRK bureau, unit or individual operator.

Defence requires employers to connect checks that often sit with different departments. Recruitment teams can corroborate identification documents against independent sources and use live or in-person verification where proportionate. Repeated changes to names, contact details or payment information, mismatches between worker and account-holder names, and reuse of identification documents across accounts should trigger further review.

Device custody is equally important. Employers should verify the delivery address, intended user and continuing control of company hardware, while monitoring for unauthorised remote-access software or configurations consistent with laptop-farm activity. Recruitment, security, payroll and compliance teams should share relevant anomalies and revalidate identity when a worker’s location, payment details or post-hire behaviour changes materially. Employment platforms should also examine anomalous account creation and registration patterns rather than relying on apparently valid documents alone.

Australia’s Department of Foreign Affairs and Trade was listed among the bodies participating in the July alert, giving the warning direct relevance to Australian employers and platforms recruiting remote workers across borders. No Australian victim or enforcement case was identified. The unresolved questions are whether the reported participants secured jobs, gained access to employer systems or knowingly supported DPRK-linked teams; the evidence available for this article does not answer them.

Recruitment, payroll and security teams each hold part of the picture when identity, payment, network and device details diverge. From that cross-team view, move into technical foundations with The Hack Academy’s online cybersecurity training programme: it offers self-paced learning and practical exercises alongside theory in listed subjects including cybersecurity fundamentals and networking.