On October 13, 2026, the FBI issued a new public service announcement, “North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment” (I-101326-PSA). It warns that North Korean remote IT workers are getting harder to spot. More and more, they rely on Americans and other third parties to do the in-person and identity work for them. The FBI also says they are looking for identities and helpers that qualify for cleared positions, cleared defense contractors, and jobs tied to government contracts.
For government contractors, the danger is not only a hostile hire. Your company, your subcontractors, and your own employees can end up helping this scheme without knowing it. We covered this threat earlier in our case study on North Korean insider and vendor threats in remote hiring. The new PSA shows how the playbook has changed.
What the FBI Reported
- North Korea uses thousands of state-controlled remote IT workers to get into Western companies. Their pay funds the regime, including its nuclear and military programs. The FBI says the regime reportedly keeps about 85–90% of what they earn.
- Most of the names and addresses they give employers are stolen. They have bought accounts or licenses from identity verification providers so they can pass background checks.
- They hire facilitators to appear on camera, sit for interviews, verify fake identities, ship packages, complete urinalysis or fingerprint submissions, and keep work laptops online at home. They often target people under financial stress, and they have targeted active-duty military members to host laptops.
- Many hold a job and then pay low-cost freelancers overseas to do the actual work.
- Some have threatened former managers, threatened to leak sensitive or proprietary data, and used U.S.-based facilitators to intimidate people in person.
How a Contractor Can Be Used Without Knowing It
The examples below are scenarios we built from the tactics the FBI describes. They are not specific cases.
1. Through a subcontractor’s “remote developer.” A prime contractor sends software work to a small subcontractor. That company hires a remote developer whose résumé and references check out, because they belong to a real person whose identity was stolen. The prime never sees the hire, yet that developer now touches the prime’s code and customer data.
2. Through a stand-in at the interview. A paid facilitator, with the experience a cleared role calls for, does the video interview and on-camera onboarding. After the offer, someone else does the work. The person you vetted and the person logging in are not the same.
3. Through a laptop shipped “home.” HR ships a company laptop to the new hire’s U.S. address. That address is really a facilitator’s house, part of a laptop farm. A KVM-over-IP device or remote access tool lets the worker control it from overseas, and sometimes the job is passed on again to a freelancer in another country.
4. Through your own employee. A current employee or service member with money trouble answers a freelance post offering cash to “host” a laptop, do an interview for someone, or loan out a professional networking account. That employee is now an insider risk, and may be breaking the law without realizing it.
5. Through a staffing vendor’s checks. A staffing partner swears it has verified identities, but its process depends on documents and accounts the worker bought. You assumed someone else did the checking.
Insider Threat and Vendor Threat Mitigation Steps
1. Verify identity throughout employment, not once. The FBI calls this “identity in depth.” Use E-Verify, multiple forms of ID, and live verification. Check again at key moments like device shipment, access upgrades, and changes to payroll details.
2. Watch the endpoint. User activity monitoring should flag remote access tools such as AnyDesk, TeamViewer, RustDesk, and Chrome Remote Desktop, KVM-over-IP hardware, and software that has nothing to do with the job. One signal proves little. Several together deserve a close look.
3. Flow requirements down to vendors. Require subcontractors and staffing partners to meet your identity verification and monitoring standards, tell you who has access, and report suspected identity fraud. Then audit them.
4. Track changes to payroll and identity details. Frequent changes to bank accounts, addresses, or online accounts are an indicator the FBI calls out. HR, IT, security, and management need to share what each of them sees.
5. Educate your workforce. Employees should know that hosting a laptop, interviewing for someone else, or lending out an account for pay is not a side gig. It is facilitation. Tell them how to report these approaches.
If you suspect an IT worker or have been approached, the FBI asks you to contact your local FBI Field Office and file a complaint at www.ic3.gov.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
We help government contractors:
- Build or assess insider threat programs that cover hiring, onboarding, and remote workers
- Run vendor threat mitigation programs that vet subcontractors and staffing partners and flow security requirements down
- Tune user activity monitoring to catch remote access tools, KVM devices, and other facilitation indicators
To talk with our team, contact info@tmpcinc.com or 813.524.6935.