The Fake Developer Problem: What the US Crackdown on North Korean IT Workers Means for Your Business

On 13 October the US Department of Justice announced one of its largest actions so far against North Korean IT workers embedded in American companies. Fourteen people were charged, two were arrested on American soil, and the FBI seized nearly 190 laptops from more than 40 homes in Texas during a single week in September. The people behind those laptops had been working as ordinary remote developers and IT specialists at US companies for years.

The numbers are uncomfortable. More than 70 US companies employed North Korean IT workers without having any idea about it. The victims were not careless startups run from a garage. They included employers in healthcare, communications, retail, manufacturing and even cyber support. Every one of them ran interviews, signed contracts, shipped laptops and paid salaries to people who did not exist.

If your company hires remote developers, whether directly, through freelance platforms or through recruiters, this story deserves ten minutes of your attention. It shows exactly where standard hiring checks break down, and what you can do about it. Let's get into it.

What the DOJ actually announced

The core of the announcement is a four-count indictment in the Northern District of Ohio covering wire fraud, money laundering and identity theft. Two US nationals, one from Pennsylvania and one from Texas, were arrested. Ten further defendants are based in China, and two more remain under seal. In total the FBI says the charges cover 14 individuals.

According to the indictment, the scheme ran from 2019 until roughly July 2025. North Korean IT workers used stolen or fabricated identity documents to get remote jobs at US companies, then routed their salaries to accounts controlled by the DPRK. The DOJ estimates the operation generated around 3 million dollars, which it believes went to sanctioned entities that fund North Korea's weapons programmes.

The arrests came with a wider sweep the FBI calls Operation Lonestar Roundup. Between 21 and 25 September, agents searched more than 40 suspected residences in Texas and seized about 187 laptops along with KVM switching devices. Security researchers at CrowdStrike track the group behind this activity under the name Famous Chollima.

How North Korean IT workers actually get hired

The mechanics are surprisingly low-tech. A North Korean worker, usually sitting in North Korea or China, applies for a remote role using a stolen American identity. The CV is solid, the portfolio is real work, and the interview answers are well rehearsed. Once hired, the company ships a work laptop to what it believes is the employee's home address in the United States.

That address belongs to a facilitator. The facilitator keeps the laptop powered on at their home, installs remote access software on it, and connects it to a KVM switch alongside a dozen other laptops from a dozen other companies. These houses full of humming machines are what investigators call laptop farms. The actual worker logs into the machine from abroad, and from the employer's side everything looks domestic: a US device, a US IP address, a US bank account for payroll.

The FBI notes the model keeps evolving. Workers now actively recruit Americans to host the machines, and in some cases they subcontract entire jobs to other foreign nationals while keeping the salary. One person can hold several full-time jobs at once this way. A 2022 government advisory estimated that a single worker can bring in up to 300,000 dollars a year.

Why standard hiring checks failed

It is tempting to assume the affected companies skipped their homework. Most of them did not. The problem is that the usual checks were designed for a different threat.

Background checks pass because the identity being checked is real, it just belongs to someone else. Video interviews pass because the person on camera either is the worker with a well-prepared story, or a paid stand-in. Document checks pass because the forged passports and driving licences are good enough for a remote process where nobody holds the physical document. Location checks pass because the laptop genuinely sits in Ohio or Texas.

This is also not the first wave. In January 2025 the DOJ indicted five people in a similar scheme that touched at least 64 American organisations, including a financial institution and two well-known tech companies in the Bay Area. In that case facilitators installed AnyDesk and TeamViewer on corporate devices, and payments from just ten of the victim companies exceeded 866,000 dollars. The pattern was known. Companies kept hiring anyway, because each individual hire looked completely normal.

The risks go further than a wasted salary

The obvious damage is financial: you pay a salary and part of it ends up with a sanctioned regime. That alone creates legal exposure, because US and EU sanctions law does not care much whether you funded a weapons programme knowingly or through negligence.

The less obvious damage is worse. These workers sit inside your systems with legitimate credentials. The FBI has repeatedly warned that some of them steal source code and sensitive data, and in several documented cases they moved to outright extortion after being fired, threatening to publish company data unless they were paid. A fake employee is not just a payroll problem. It is an insider threat with a valid login.

And then there is the quality question that nobody likes to ask. If your developer is actually three different people sharing an identity, or one person juggling five jobs, the code they ship and the decisions they make are not what you believed you were paying for.

Practical checks that actually help

The good news is that the scheme has weak points, and most of them can be tested without turning your hiring process into an interrogation. The FBI published detailed guidance alongside the announcement, and some patterns come up again and again.

Watch the logistics, not just the person. A shipping address that differs from the stated home address is a classic sign, especially when the candidate asks to send the laptop to a relative or a friend. Repeated changes of address or payment details early in the employment are another one.

Verify identity live, not from scans. A short onboarding call where the new hire shows their physical ID on camera, next to their face, defeats most document fraud. Notarised verification is an option for sensitive roles. During regular work, sudden refusal to turn the camera on, or a person on camera who looks or sounds different from the interviews, deserves a direct question.

Check the technical signals. Remote access tools like AnyDesk or TeamViewer appearing on a corporate laptop that should not need them is a red flag your IT team can monitor automatically. The same goes for logins that bounce between distant time zones, or a worker who is permanently active at 3am local time while claiming to live in Chicago.

Call the references properly. Facilitated workers usually provide references that route back to their own network. Looking up the referenced company's official phone number yourself, instead of using the number in the CV, costs five minutes and breaks that loop.

What this means if you outsource development

For businesses that buy development services rather than hire employees, the lesson is slightly different. The risk concentrates where anonymity is highest: individual contractors found on marketplaces, hired quickly, paid to personal accounts, never met.

Working with an established agency changes the risk profile, not because agencies are magic, but because there is a verifiable legal entity, an office you can look up, named people who appear on video calls over years, and a reputation that took a decade to build and would take one scandal to lose. Whoever you work with, the principle is the same: know who is actually behind the keyboard. Meet the team on video, not just the sales person. Sign contracts with a real company, not a display name. Ask where the people physically sit, and expect a straight answer.

None of this guarantees anything on its own. Together, it makes you a much harder target than the next company in the pipeline, and these schemes are volume businesses that go where the resistance is lowest.

Final notes

The October crackdown will not end the operation. The DOJ itself describes the scheme as adaptive: when US facilitators get arrested, recruitment shifts abroad; when one revenue channel closes, another opens. AI tools are already making the fake personas cheaper to produce and the interview performances more convincing.

What has changed is that nobody can claim this is an exotic edge case anymore. Over 70 companies in this indictment, 64 in the last one, and those are only the schemes that got caught. Remote hiring is not going away, and it should not. It just needs to be treated as a security process, not only an HR process. The companies that got burned were not stupid. They were simply checking the things that used to be worth checking, while the threat had moved on.