FBI warns North Korean IT workers steal code and extort employers: tighten remote-hiring checks and data monitoring

An FBI public service announcement says North Korean IT workers discovered on company networks have extorted victims by holding stolen data and code hostage, and have used AI and face-swapping in video interviews. It recommends least privilege, monitoring for unusual remote access and exfiltration, and identity verification throughout remote hiring.

Source facts

The FBI’s public service announcement on North Korean IT workers says that after being discovered on company networks, the workers have extorted victims by holding stolen proprietary data and code hostage until ransom demands are met, and in some cases have publicly released victims’ code. It says they have copied company code repositories to personal accounts and could harvest credentials and session cookies to work from non-company devices.

For data monitoring, the FBI recommends least privilege, including disabling local administrator accounts and limiting rights to install remote desktop applications, and investigating unusual remote connections and prohibited remote desktop software. It says the workers often log in to one account several times in a short period from IP addresses in different countries, and recommends monitoring for exfiltration through shared drives, cloud accounts and private code repositories.

For hiring, the FBI recommends identity verification during interviewing, onboarding and throughout employment, cross-checking HR systems for applicants with the same resume content or contact information, and completing as much of the hiring and onboarding process as possible in person. It says the workers have used AI and face-swapping during video interviews and reused phone numbers and email addresses across resumes, and it asks that suspected cases be reported to IC3.

Applicability

Use this for any organization that hires remote technical staff or contractors, directly or through staffing firms. The announcement builds on earlier advisories from 2022, 2023 and May 2024.

DSE recommendation

DSE recommends verifying the identity of every remote IT hire in person or through a trusted process, and monitoring new contractors’ access for the warning signs the FBI lists. Require company-managed devices for code and administrative access, ship equipment only to verified addresses, flag payment or address changes during onboarding, and alert on concurrent sign-ins from different countries.

Verification

Audit recent remote hires against the verification steps, review sign-in logs for logins from multiple countries and for remote desktop tools, and confirm staffing firms document their own identity checks.

Official reference

FBI Internet Crime Complaint Center — North Korean IT Workers Conducting Data Extortion (PSA250123). Reviewed October 19, 2026.