An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.
\nThe FBI’s public service announcement on North Korean IT workers says that after being discovered on company networks, the workers have extorted victims by holding stolen proprietary data and code hostage until ransom demands are met, and in some cases have publicly released victims’ code. It says they have copied company code repositories to personal accounts and could harvest credentials and session cookies to work from non-company devices.
\nFor data monitoring, the FBI recommends least privilege, including disabling local administrator accounts and limiting rights to install remote desktop applications, and investigating unusual remote connections and prohibited remote desktop software. It says the workers often log in to one account several times in a short period from IP addresses in different countries, and recommends monitoring for exfiltration through shared drives, cloud accounts and private code repositories.
\nFor hiring, the FBI recommends identity verification during interviewing, onboarding and throughout employment, cross-checking HR systems for applicants with the same resume content or contact information, and completing as much of the hiring and onboarding process as possible in person. It says the workers have used AI and face-swapping during video interviews and reused phone numbers and email addresses across resumes, and it asks that suspected cases be reported to IC3.
\nUse this for any organization that hires remote technical staff or contractors, directly or through staffing firms. The announcement builds on earlier advisories from 2022, 2023 and May 2024.
\nDSE recommends verifying the identity of every remote IT hire in person or through a trusted process, and monitoring new contractors’ access for the warning signs the FBI lists. Require company-managed devices for code and administrative access, ship equipment only to verified addresses, flag payment or address changes during onboarding, and alert on concurrent sign-ins from different countries.
\nAudit recent remote hires against the verification steps, review sign-in logs for logins from multiple countries and for remote desktop tools, and confirm staffing firms document their own identity checks.
\nFBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123). Reviewed October 19, 2026.
", "content_text": "An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.\nSource facts\nThe FBI’s public service announcement on North Korean IT workers says that after being discovered on company networks, the workers have extorted victims by holding stolen proprietary data and code hostage until ransom demands are met, and in some cases have publicly released victims’ code. It says they have copied company code repositories to personal accounts and could harvest credentials and session cookies to work from non-company devices.\nFor data monitoring, the FBI recommends least privilege, including disabling local administrator accounts and limiting rights to install remote desktop applications, and investigating unusual remote connections and prohibited remote desktop software. It says the workers often log in to one account several times in a short period from IP addresses in different countries, and recommends monitoring for exfiltration through shared drives, cloud accounts and private code repositories.\nFor hiring, the FBI recommends identity verification during interviewing, onboarding and throughout employment, cross-checking HR systems for applicants with the same resume content or contact information, and completing as much of the hiring and onboarding process as possible in person. It says the workers have used AI and face-swapping during video interviews and reused phone numbers and email addresses across resumes, and it asks that suspected cases be reported to IC3.\nApplicability\nUse this for any organization that hires remote technical staff or contractors, directly or through staffing firms. The announcement builds on earlier advisories from 2022, 2023 and May 2024.\nDSE recommendation\nDSE recommends verifying the identity of every remote IT hire in person or through a trusted process, and monitoring new contractors’ access for the warning signs the FBI lists. Require company-managed devices for code and administrative access, ship equipment only to verified addresses, flag payment or address changes during onboarding, and alert on concurrent sign-ins from different countries.\nVerification\nAudit recent remote hires against the verification steps, review sign-in logs for logins from multiple countries and for remote desktop tools, and confirm staffing firms document their own identity checks.\nOfficial reference\nFBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123). Reviewed October 19, 2026.", "content_markdown": "An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.\n\n## Source facts\n\nThe FBI’s [public service announcement on North Korean IT workers](https://www.ic3.gov/PSA/2025/PSA250123) says that after being discovered on company networks, the workers have extorted victims by holding stolen proprietary data and code hostage until ransom demands are met, and in some cases have publicly released victims’ code. It says they have copied company code repositories to personal accounts and could harvest credentials and session cookies to work from non-company devices.\n\nFor data monitoring, the FBI recommends least privilege, including disabling local administrator accounts and limiting rights to install remote desktop applications, and investigating unusual remote connections and prohibited remote desktop software. It says the workers often log in to one account several times in a short period from IP addresses in different countries, and recommends monitoring for exfiltration through shared drives, cloud accounts and private code repositories.\n\nFor hiring, the FBI recommends identity verification during interviewing, onboarding and throughout employment, cross-checking HR systems for applicants with the same resume content or contact information, and completing as much of the hiring and onboarding process as possible in person. It says the workers have used AI and face-swapping during video interviews and reused phone numbers and email addresses across resumes, and it asks that suspected cases be reported to IC3.\n\n## Applicability\n\nUse this for any organization that hires remote technical staff or contractors, directly or through staffing firms. The announcement builds on earlier advisories from 2022, 2023 and May 2024.\n\n## DSE recommendation\n\nDSE recommends verifying the identity of every remote IT hire in person or through a trusted process, and monitoring new contractors’ access for the warning signs the FBI lists. Require company-managed devices for code and administrative access, ship equipment only to verified addresses, flag payment or address changes during onboarding, and alert on concurrent sign-ins from different countries.\n\n## Verification\n\nAudit recent remote hires against the verification steps, review sign-in logs for logins from multiple countries and for remote desktop tools, and confirm staffing firms document their own identity checks.\n\n## Official reference\n\n[FBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123)](https://www.ic3.gov/PSA/2025/PSA250123). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/", "url": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "FBI warns North Korean IT workers steal code and extort employers: tighten remote-hiring checks and data monitoring", "item": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/#article", "identifier": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/", "url": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/", "headline": "FBI warns North Korean IT workers steal code and extort employers: tighten remote-hiring checks and data monitoring", "description": "An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code…", "abstract": "An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.", "articleBody": "An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.\nSource facts\nThe FBI’s public service announcement on North Korean IT workers says that after being discovered on company networks, the workers have extorted victims by holding stolen proprietary data and code hostage until ransom demands are met, and in some cases have publicly released victims’ code. It says they have copied company code repositories to personal accounts and could harvest credentials and session cookies to work from non-company devices.\nFor data monitoring, the FBI recommends least privilege, including disabling local administrator accounts and limiting rights to install remote desktop applications, and investigating unusual remote connections and prohibited remote desktop software. It says the workers often log in to one account several times in a short period from IP addresses in different countries, and recommends monitoring for exfiltration through shared drives, cloud accounts and private code repositories.\nFor hiring, the FBI recommends identity verification during interviewing, onboarding and throughout employment, cross-checking HR systems for applicants with the same resume content or contact information, and completing as much of the hiring and onboarding process as possible in person. It says the workers have used AI and face-swapping during video interviews and reused phone numbers and email addresses across resumes, and it asks that suspected cases be reported to IC3.\nApplicability\nUse this for any organization that hires remote technical staff or contractors, directly or through staffing firms. The announcement builds on earlier advisories from 2022, 2023 and May 2024.\nDSE recommendation\nDSE recommends verifying the identity of every remote IT hire in person or through a trusted process, and monitoring new contractors’ access for the warning signs the FBI lists. Require company-managed devices for code and administrative access, ship equipment only to verified addresses, flag payment or address changes during onboarding, and alert on concurrent sign-ins from different countries.\nVerification\nAudit recent remote hires against the verification steps, review sign-in logs for logins from multiple countries and for remote desktop tools, and confirm staffing firms document their own identity checks.\nOfficial reference\nFBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123). Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:27:40+00:00", "dateModified": "2026-10-19T01:55:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/fbi-north-korean-it-workers-extortion-remote-hiring-verification/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "FBI warns North Korean IT workers steal code and extort employers: tighten remote-hiring checks and data monitoring" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Important priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 394, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "FBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123)", "url": "https://www.ic3.gov/PSA/2025/PSA250123" } } ] } }