Detecting DPRK IT Workers Before They're on Your Payroll

Scope

This guide provides operational controls and detection strategies for fraud managers to identify North Korean IT worker schemes during hiring and employment. It focuses on identity fabrication, cryptocurrency transaction patterns, and specific red flags that distinguish these state-sponsored operatives from legitimate contractors.

You'll find detailed requirements linked to OFAC designations from October 28, 2026, targeting individuals and entities involved in DPRK IT worker fraud, which generates $250 to $600 million annually for the North Korean regime.

This guide does not cover post-hire incident response or legal remediation after discovering a DPRK operative in your systems.

Key Concepts and Definitions

DPRK IT Worker Scheme: A North Korean government operation where workers use stolen identities, fabricated credentials, and proxy infrastructure to secure employment at legitimate companies. Most earnings flow to the regime; workers may also steal data or deploy malware.

Laptop Farm: A U.S.-based proxy setup where facilitators forward equipment to DPRK workers abroad, creating the appearance of a domestic presence during remote work.

AI-Fabricated Identity: The use of generative AI to create tailored resumes, cover letters, interview responses, and deepfake video that conceals the applicant's true identity and location.

Conversion Network: Financial intermediaries who transform cryptocurrency earnings from DPRK workers into cash. In the October 2026 action, Russian national Vitold Viktorovich Obertas converted nearly $2 million in cryptocurrency for DPRK officials since January 2025.

Chinyong Information Technology Cooperation Company: A DPRK umbrella entity designated by OFAC in 2023 that manages IT worker delegations. The October 2026 action targeted two managers reporting to Chinyong: Kim Ki Hyok and Kim Hyo Dong.

Requirements Breakdown

Screening Obligations

Under OFAC sanctions regulations (31 CFR Part 501), you must screen all employees, contractors, and payees against the Specially Designated Nationals and Blocked Persons List. The October 28, 2026 designations add:

• 10 individuals involved in DPRK IT worker operations
• First Financial and Technical Development Center (FFTDC), a Russia-based DPRK-controlled entity
• Associated cryptocurrency addresses used for conversion and laundering

Screen before onboarding and whenever OFAC updates the SDN List.

Transaction Monitoring

If you process payments via cryptocurrency, monitor for exposure to designated addresses. The designated individuals moved funds through:

• Mainstream exchanges for initial deposits
• Sanctioned Russian exchange Garantex for cashout
• Consolidation wallets that aggregate earnings from multiple IT workers

Blocking Without Delay

Upon identifying a match to a designated person or entity, freeze all property and interests in property within your control. This includes:

• Unpaid wages or contractor fees
• Equipment issued to the worker
• Access credentials and intellectual property created during employment

Implementation Guidance

Pre-Hire Detection Points

Application Review

Watch for resumes that mirror job postings too precisely. DPRK operatives use generative AI to tailor applications, producing documents with suspiciously perfect keyword matches. Check for profile photos that appear AI-generated. Look for inconsistencies in lighting, background blur, or facial symmetry. Reverse image search can reveal stock photos or duplicated profiles.

Interview Process

Conduct video interviews with cameras on. DPRK workers have used deepfake video during hiring calls, but real-time interaction makes this harder to sustain. Ask unscripted questions that require the candidate to think aloud or explain their reasoning process. Verify the candidate's location through multiple signals. If they claim to be in the U.S., ask about local details (weather, recent news, time zone) that would be difficult for someone abroad to fabricate in real time.

Reference Verification

Call references directly using numbers you find independently, not numbers the candidate provides. DPRK facilitators operate networks that include fake references who'll vouch for the worker. For technical roles, ask references specific questions about the candidate's work style, communication patterns, and collaboration approach. Generic praise without concrete examples is a red flag.

Payment Controls

Cryptocurrency Red Flags

If a contractor requests payment in cryptocurrency, especially stablecoins, escalate to your compliance team. The six Russia-based DPRK IT workers designated on October 28, 2026 collectively generated more than $750,000 for FFTDC, primarily through crypto transfers. Monitor for bi-weekly stablecoin transfers that resemble salary payments. Chainalysis research identified DPRK IT worker wallets receiving regular transfers from late 2022 to early 2023, which were then converted to ETH and passed to consolidation addresses.

Banking Pattern Analysis

Watch for contractors who request payment to accounts that don't match their stated location or identity. DPRK networks use intermediaries to receive funds, then convert and transfer them through multiple jurisdictions. Flag requests to change payment details mid-contract, especially if the new account is in a different country or uses a different name.

Access Monitoring

VPN and Proxy Detection

Log all VPN connections and flag workers whose IP addresses shift between countries or who connect through known proxy services. The FBI's May 2022 joint advisory noted that DPRK IT workers use VPNs and proxy infrastructure to fake their location. Monitor for laptop farm indicators: equipment shipped to a U.S. address that then connects from overseas IP ranges, or multiple "employees" connecting from the same residential address.

Data Exfiltration Signals

DPRK workers exploit network access to steal sensitive data. Watch for unusual file downloads, especially of proprietary code, customer data, or system architecture documentation. Flag access to systems or repositories outside the worker's assigned scope, particularly if it occurs during off-hours for their stated time zone.

Common Pitfalls

Over-Reliance on Document Verification

Don't assume that a valid-looking passport or driver's license confirms identity. DPRK operatives use stolen identities backed by genuine documents. Your verification process must include live interaction and behavioral signals.

Ignoring Cryptocurrency Payment Requests

Some fraud teams treat crypto payment requests as merely unusual rather than high-risk. Since 2025, cryptocurrency has been the primary payment method for DPRK IT worker schemes because it enables cross-border transfers without traditional banking controls.

Failing to Monitor Existing Employees

Most screening happens at hire, but DPRK operatives may have been hired before you implemented stronger controls. Run periodic rescreening against updated SDN Lists and watch for the behavioral red flags described above.

Treating AI-Fabricated Applications as Ordinary Fraud

Standard resume fraud involves exaggerating qualifications. AI-fabricated identities are fundamentally different: they create entirely synthetic personas optimized for your specific posting. Your screening must look for the patterns that reveal synthetic generation, not just inflated claims.

Quick Reference Table

Your screening process should trigger escalation to your MLRO if two or more red flags appear for the same applicant or employee. Act promptly on these signals to prevent DPRK IT worker schemes from exploiting your organization.