Working for Google, Amazon and more: Kim Jong-un’s North Korean hackers posing as U.S. developers
Remote working has allowed companies to tap talent around the world, but some are unexpectedly helping finance North Korea with their new hires.
The revolution in IT technology has allowed talented professionals to become internet nomads, remote working from anywhere in the world. This has been a boon for companies seeking talent but at the same time opened a new opportunity for the despotic regime in North Korea.
Companies, including those on the Fortune 500 list, have been unwittingly hiring IT workers from Kim Jong Un’s Hermit Kingdom who pose as Americans using stolen identities. The impostors are then funneling as much as 90% of their high-paying salaries to the Pyongyang government. These funds are then used to finance the rogue nation including its nuclear weapons program.
Furthermore, their jobs give them access to sensitive data that can later be used to extort businesses or provide backdoors to company databases to be hacked or for espionage. This has prompted warnings from the FBI which has been cracking down on those who help these North Korean IT workers appear to be working from the United States.
North Korean IT scam has generated $250 million to $600 million per year
Since 2018, the United Nations estimates that embedding North Korean IT workers in companies has generated between $250 million to $600 per year for Pyongyang reports Fortune. And North Korea is ramping up its efforts to expand the scam even as US authorities and cybersecurity experts are working to make it more difficult.
North Korea has dispatched thousands of skilled IT workers abroad with the aim of deceiving U.S. and other businesses worldwide into hiring them as freelance IT workers so they can support North Korean cyber operations and generate revenue for the North Korean regime. Learn more… pic.twitter.com/qctMta67BF
— NCSC (@NCSCgov) April 3, 2025
Artificial intelligence has allowed these fake American IT workers to hide their identities, disguising their appearance and voices to remove accents or change it so that they sound like a woman instead of a man. Some of these North Korean workers are holding multiple jobs at a time, as many as six or seven with the use of AI tools.
“Right now, we have North Korean IT workers adapting so much that they’re not even doing IT work anymore,” Michael Barnhart told Fortune. The intelligence leader at Google Cloud has been tracking North Korean threats for several years says that they are disguising themselves as legitimate recruiting firms or web-design agencies which are then unwittingly hired by larger Fortune 500 companies not realizing that it’s a front for a North Korean scam.
A novel approach to stopping the scam
While cybersecurity experts are teaming up and sharing information to help thwart these scams, the founder of a crypto startup has found a way to stop the scam before he even gives an interview. Harrison Leggio of g8keep, who says roughly 95% of the résumés he gets in response to job postings are North Korean impostors, makes a simple request from the get-go: “Say something negative about Kim Jong Un.”
North Korea's IT Army is expandeding operations beyond the U.S. and are now increasingly targeting organizations across Europe.
— Visegrád 24 (@visegrad24) April 3, 2025
Also referred to as "IT warriors," they hide their true identities and pose as workers based in other countries by connecting via laptop farms to… pic.twitter.com/tEhcOpxxCf
“The first time I ever did it, the person started freaking out and cursing,” Leggio told Fortune. He explained that he learned that it’s forbidden to insult the Supreme Leader of North Korea and that they could face serious punishment for doing so after some research.
Get your game on! Whether you’re into NFL touchdowns, NBA buzzer-beaters, world-class soccer goals, or MLB home runs, our app has it all.
Dive into live coverage, expert insights, breaking news, exclusive videos, and more – plus, stay updated on the latest in current affairs and entertainment. Download now for all-access coverage, right at your fingertips – anytime, anywhere.