On October 13, 2026, the FBI's Internet Crime Complaint Center published a public service announcement titled "North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment." The same week, the Department of Justice announced arrests tied to "laptop farms," homes in the United States where company-issued laptops sat plugged in and running so that workers overseas could log in as if they were local employees.
It is easy to read this as a problem for large technology companies. The victim list says otherwise, and so does the FBI's own description of who is being targeted. Any organization that hires remote staff or remote contractors, and that includes many medical practices, small manufacturers, and defense subcontractors, should treat this warning as its own.
What happened
Help Net Security summarized the Justice Department's announcement: "North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice." The report adds: "The victims include health care, communications, retail and manufacturing companies in 17 states and the District of Columbia."
According to the same report, FBI agents in Texas searched more than 40 suspected laptop farms between September 21 and 25, "seizing about 187 laptops and KVM (keyboard, video, mouse) devices." Prosecutors allege that two men and their co-conspirators sent about $3 million in earnings to accounts controlled by North Korea. The charges are allegations, and the defendants are presumed innocent unless proven guilty. The Record reported that this is not new ground: "Nearly 30 laptop farms across 16 states were raided last year by U.S. law enforcement."
The money matters because of where it goes. The FBI states that North Korea receives "an estimated 85-90% of the revenue the actors generate." A paycheck sent to one of these workers funds a sanctioned government, and the access that comes with the job can be used for theft or extortion.
How the scheme works
The FBI describes a network that has grown more organized. Workers apply for remote jobs using names, addresses, and work histories built largely from stolen identities. When an employer ships a laptop, it goes to an American "facilitator" who keeps it powered on and connected, and the worker controls it remotely from abroad. Some workers subcontract the job itself to freelancers, "usually in Pakistan, India, Nigeria, or neighboring countries," so the person doing the work may not even be the person who interviewed.
The PSA singles out one group of employers directly: "ITWs target positions with cleared defense contractors and other companies involved in U.S. government contracts." ITW is the FBI's shorthand for North Korean IT worker. A small subcontractor with a single remote developer or IT administrator is exactly the kind of organization that may not have a full background investigation process for every hire.
The warning signs the FBI lists
The PSA lists several technical and behavioral indicators. On the technical side: "ITWs continue to use remote desktop software to connect to employment-related devices. Examples include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software." The FBI also notes hardware that lets someone control a laptop over the internet without any software at all: "ITWs use external hardware such as TinyPilot, PiKVM, GL.iNet, and other Keyboard Video Mouse (KVM) over IP devices to control laptops."
On the administrative side, the pattern is churn. In the FBI's words: "ITWs tend to rotate through bank accounts, street addresses, social media accounts or other identifiers at an unusually high rate due to account bans and other disruptions." A new hire who changes direct deposit details twice in a month, asks to ship equipment to a different address at the last minute, or will not appear on camera is worth a closer look.
No single sign proves anything
The FBI is careful on this point, and small employers should be too: "U.S. companies should recognize the scale, persistence, and rapid evolution of the North Korean ITW threat means ITWs cannot be identified reliably with a single indicator." Plenty of honest remote workers use remote desktop tools, move apartments, or switch banks. The PSA itself warns that aggressive controls carry a risk of "false positives that could harm legitimate employees and filter out qualified applicants."
The FBI's answer is what it calls an "identity in depth" approach: layered checks across the whole employment lifecycle, from the application to the last day of work, instead of a single gate at the interview. It also notes that "Cross-functional collaboration between internal teams enhances detection effectiveness." In a small business, that means the owner, whoever handles hiring and payroll, and whoever manages the computers compare notes before anyone draws a conclusion.
Six steps for a small business
- Verify identity live and in layers. Hold at least one live video interview, compare government identification with the person on camera, and use E-Verify where it applies. The PSA notes that "Using E-Verify, requiring a U.S. passport, multiple forms of identification, or live verification can raise friction for ITWs."
- Ship equipment only to a verified address. Confirm the shipping address separately from the application, and treat a last-minute change of destination as a reason to pause and verify again.
- Control remote access tools on company devices. Decide which remote support tool your organization uses, block the others, and ask your IT provider to alert you when unapproved remote desktop software appears. Our post on third-party risk covers what to ask the provider who manages those tools.
- Ask contractors who does the work. For remote IT, coding, or billing contractors, put in writing that the named person performs the work and may not subcontract it without your approval.
- Watch payroll and personnel changes. Have payroll flag repeated changes to bank accounts or addresses for a new hire, and confirm each change by a phone call to a number you already have on file. The same habit stops ordinary payroll diversion fraud, which we covered in our verification discipline guide.
- Plan the response before you need it. If you suspect a fraudulent worker, preserve the device and its records, contact your local FBI field office, and file a report at ic3.gov. Get legal advice before ending the relationship. The FBI reports that "Following termination, ITWs have made death threats against former managers and their families to collect additional payments."
Why this belongs in a security conversation
Most small business security planning assumes the threat is outside, trying to get in. This scheme turns that around. The attacker applies, gets hired, receives a laptop and an account, and is handed the access an intruder would otherwise have to steal. For a practice that holds patient records, or a subcontractor that holds a customer's technical data, that is a breach that starts in the hiring process.
None of the steps above require special tools. They require that hiring, payroll, and IT talk to each other, and that the first time a business checks who it hired is before the laptop ships, not after something goes wrong.
Sources
- North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment, Alert I-101326-PSA, October 13, 2026 - FBI Internet Crime Complaint Center
- FBI raids 40+ laptop farms helping North Korea pocket US tech salaries, October 14, 2026 - Help Net Security
- Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue, October 13, 2026 - The Record from Recorded Future News
Check who has access before the laptop ships
Adams Cloud & Cybersecurity helps small businesses set up practical identity checks for remote hires, control remote access tools, and respond when something does not add up.
Book a free consultation