Fake remote IT workers: North Korean laptop farms dismantled, and what SMBs should check
On October 13, 2026, the U.S. Department of Justice announced an operation against fake remote IT workers working for North Korea: 14 people charged, two arrests and about 187 laptops and KVM devices seized from “laptop farms” in Texas. No hacker forcing the door here: the fraudsters were hired, received a company laptop and collected a salary, sometimes for years.
The same day, the FBI published an advisory (I-101326-PSA) describing how the scheme is evolving and targeting “western companies.” The named victims are American, but any SMB hiring freelancers or 100% remote IT staff should read what follows: nothing stops fake remote IT workers from applying to your company.
The operation in numbers
14
people charged in Ohio, including 2 Americans arrested
70+
employer companies affected from 2019 to 2025
~187
laptops and KVM devices seized
40+
residences searched in Texas (Sept. 21-25)
~US$3M
in revenue generated by the fake workers
85-90%
of revenue captured by the regime, per the FBI
According to the indictment, from 2019 to July 2025 the fake workers landed remote jobs at more than 70 companies (health care, communications, cyber support, retail, manufacturing) using stolen or fabricated identities. The U.S. Treasury estimates this type of scheme brought the regime more than $800 million in fiscal 2024, according to U.S. Attorney Ryan Raybould, quoted by CBS Texas.
How a “laptop farm” works
The company ships its new hire’s laptop to a U.S. address. A paid accomplice plugs it in at home, installs remote access software or a KVM-over-IP device, and leaves it on. The “worker,” abroad, connects to it and appears to work from the declared address. According to the FBI, the networks now pay accomplices to sit interviews for them, pass identity checks or lend their professional accounts, and sometimes subcontract the entire job to freelancers in Pakistan, India or Nigeria. After being fired, some have threatened former managers or demanded ransom for stolen data.
Fake remote IT workers: the hiring funnel and its warning signs
The FBI insists: no single sign is enough, since each can have an innocent explanation. It’s the build-up from one stage to the next that should trigger a check.
🚩 Signs to watch
- “Borrowed” professional profile: years of history, but a different person
- Address, phone or bank account that changes often
- Name, photo and work history that don’t quite match
✅ Simple check
- Check references through a number you find yourself, not the one on the résumé
- Compare the profile history with the résumé and the interview
🚩 Signs to watch
- Camera that “doesn’t work,” frozen or lagging image
- A different person from earlier interviews
- Answers that seem dictated or read
✅ Simple check
- At least one live interview, camera on, with unscripted questions
- If possible, an in-person meeting before hiring
🚩 Signs to watch
- Poor-quality or inconsistent ID documents
- Pay requested to a third party’s account or a foreign payment platform
✅ Simple check
- Check several ID documents, live (the FBI recommends this friction)
- Pay only into an account in the employee’s name
🚩 Signs to watch
- Delivery address different from the declared home address
- Request to ship “to a friend” or “temporarily” elsewhere
✅ Simple check
- Ship to the verified address, or hand it over in person
- Managed laptop: configuration locked before shipping
🚩 Signs to watch
- Remote control software (AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop…)
- KVM-over-IP devices (TinyPilot, PiKVM, GL.iNet) or a video capture card showing up as a “webcam”
- Work quietly subcontracted: quality or style changing overnight
✅ Simple check
- Block unapproved remote access tools
- Alert on any new USB device or installed software
- Verified sign-ins: country, hours, device
“Identity in depth”: 4 layers instead of one filter
The FBI’s recommended principle, applied to an SMB (from the outside in)
Layer 1 · Hiring
Live identity verification, references you contact yourself, at least one camera-on interview. HR and IT talk before day one.
Layer 2 · Device
Managed laptop, unapproved remote access tools blocked, USB device inventory.
Layer 3 · Access
Multifactor authentication, conditional access (country, compliant device), least privilege: a new freelancer doesn’t need all of SharePoint.
Layer 4 · Monitoring
Proactive monitoring of your systems helps spot: sign-in from an unexpected country, new remote control software, abnormal download volume.
⚖️ Beware of blunt filters
The FBI warns that overly aggressive controls (name ban lists, exclusion based on origin) screen out legitimate candidates and penalize identity theft victims. In Quebec, the Charter of Human Rights and Freedoms also prohibits discrimination based, among other grounds, on ethnic or national origin. The right approach: verify the identity and behaviour of all remote candidates and employees, the same way.
If you have doubts about a remote employee or freelancer
- Don’t confront or fire on impulse. Coordinate IT, HR and management first: the FBI reports threats and extortion after firings.
- Preserve the evidence: sign-in logs, list of installed software, emails, payments.
- Cut access in a coordinated way, all at once: Microsoft 365 account, VPN, cloud tools, access tokens, file shares.
- Report it to the Canadian Anti-Fraud Centre and your police service, and notify your cyber insurer if you have one.
The remote control tools at the heart of this scheme are the same ones fraudsters hijack elsewhere: see our decision tree on hijacked remote access tools. On the onboarding side, a structured first week for new hires is also the right time to check access. NeoTech can set up conditional access and device management in your Microsoft 365 services, and our cybersecurity services include proactive monitoring of your systems.
Book your free cyber check
During the free cyber check, we review with you the access your remote employees and freelancers have, the remote control software installed and your onboarding and offboarding process.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- U.S. Department of Justice — Coordinated Actions to Combat North Korean Remote IT Worker Schemes (October 13, 2026)
- FBI / IC3 — North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (I-101326-PSA, October 13, 2026)
- CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme (October 13, 2026)
- CBS Texas — North Texas federal officials promise indictments after busting alleged North Korean “laptop farms” (October 13, 2026)
Photo: Mikhail Nilov, Pexels (Pexels licence).