The U.S. State Department joined 10 other governments in issuing a formal alert warning companies worldwide that North Korean IT workers are infiltrating their workforces using stolen and fabricated identities, funneling their earnings back to fund North Korea’s nuclear weapons and ballistic missile programs.
“The U.S. and international partners issued a warning: North Korean IT workers are using stolen identities to infiltrate global companies and steal funds for weapons programs,” the State Department wrote on X. “We urge all countries, companies, and others to strengthen hiring safeguards to counter their tactics.”
The official alert, dated July 31, was jointly issued by the State Department and FBI alongside government agencies from Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom. “North Korea relies upon a network of skilled Information Technology (IT) workers, deployed within and outside of North Korea, to obtain false identities and remotely earn income to fund North Korea’s unlawful nuclear weapons and ballistic missile programs,” the alert states.
According to the alert, North Korean IT workers impersonate nationals of other countries to secure remote jobs through online platforms, then remit their salaries to North Korean government agencies. Beyond generating revenue, the workers pose an insider threat once employed, engaging in data exfiltration, cryptocurrency theft and theft of sensitive company information. The alert says the workers “employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally.”
The alert details specific tactics the workers use to avoid detection, including using images of identification documents provided by third-party proxies to register accounts while the actual work is performed by the North Korean operative, participating in job interviews through intermediaries to build false trust, and requesting payment via money transfer services or cryptocurrency routed through third parties’ bank accounts in exchange for a fee. The document also describes North Korean IT workers operating “laptop farms,” in which facilitators in other countries, including the United States, receive company-issued laptops and allow the workers to access them remotely from North Korea, China, Russia, or Southeast Asian and African countries, obscuring their true location.
The alert lists specific warning signs for companies to watch for, including mismatches between an applicant’s name and their registered payment account, multiple accounts created using the same identification document, forged or digitally altered identification documents, a single account accessed from multiple IP addresses within a short period, refusal to participate in video conference interviews, video feeds that appear manipulated or artificially generated, offers to work below market rate, and requests for payment specifically in cryptocurrency. The alert also notes that accounts may show signs of being operated by multiple people, since North Korean IT workers often work in teams that rotate depending on the time of day.
The alert cites United Nations Security Council Resolution 2397, which requires all UN member states to repatriate North Korean nationals earning income within their jurisdiction, with limited exceptions. It also warns that contracting with or paying North Korean IT workers may violate domestic laws in multiple countries, including the United States, Japan and South Korea, exposing companies to legal consequences or financial penalties. The document notes the Financial Action Task Force has designated North Korea a high-risk jurisdiction subject to a call for action, its most serious blacklist category, due in part to revenue generated through IT worker schemes supporting its weapons of mass destruction program.
The alert builds on earlier joint warnings, including an August 2025 “Joint Statement on North Korean IT Workers” issued by Japan, the United States and South Korea, and a second report released in October 2025 by the Multilateral Sanctions Monitoring Team examining North Korea’s evasion of UN sanctions through cyber and IT worker activity. State Department Spokesperson Tommy Pigott described the same underlying threat in March, when the department announced sanctions against two entities and six individuals involved in North Korean IT worker schemes. “These government-orchestrated schemes systematically defraud U.S. businesses and direct the illicit proceeds toward the DPRK’s weapons of mass destruction and ballistic missile programs,” Pigott said at the time. “DPRK-facilitated IT teams commonly use fraudulent documentation, stolen identities, and fabricated personas to conceal their true identities and gain employment with legitimate companies worldwide.”
The FBI separately released a companion cybersecurity advisory the same day through its Internet Crime Complaint Center, providing additional technical detail for network defenders and human resources departments screening job applicants.
The alert calls on companies operating online hiring and contracting platforms to strengthen identity verification procedures, including stricter review of identification documents and requiring in-person or live video interviews, and to implement systems that flag anomalous account activity for further review.
The State Department followed its initial post with a second one directing readers to the full text of the alert, writing, “Read the full alert,” and linking directly to the state.gov release.
North Korea’s government has not issued a public response to the joint alert.