DOJ Announces Actions Against North Korean IT Schemes Affecting Over 70 U.S. Companies

The Department of Justice reported coordinated efforts to combat schemes involving North Korean workers using stolen identities at dozens of American firms.

Threat Times Intrusion DeskOctober 18, 20262 min read

Share LinkedIn Reddit

Illustration: A blank laptop sits on a cluttered desk next to a folded identification badge and a stack of generic manila folders. — AI-generated illustration: Threat Times

Key points

The Justice Department announced coordinated actions against North Korean remote IT worker schemes.
These schemes affected more than 70 U.S. companies, according to the agency announcement.
A Security Affairs headline states North Korean IT workers used stolen U.S. identities to earn $3 million.

The U.S. Department of Justice announced coordinated actions to combat North Korean remote IT worker schemes affecting more than 70 U.S. companies. This disclosure highlights federal efforts to address illicit labor operations linked to Pyongyang-based actors.

A headline in the Security Affairs newsletter states that North Korean IT workers used stolen U.S. identities to earn $3 million. The Justice Department’s announcement specifically targets these remote worker schemes, noting the involvement of more than 70 U.S. companies. The source material does not detail the specific methods used to access corporate networks.

Operational Scope and Financial Impact

The Security Affairs headline indicates that $3 million was earned through the use of stolen U.S. identities. This financial figure is presented in the context of the newsletter’s summary of international press. The Justice Department’s focus on more than 70 affected companies suggests a widespread issue. The specific mechanisms of how these workers accessed corporate networks were not detailed in the Justice Department’s announcement.

The agency’s coordinated actions aim to combat these schemes. By targeting the infrastructure and individuals involved in these remote work arrangements, the Department of Justice seeks to disrupt the operations. The use of stolen U.S. identities is a key component mentioned in the Security Affairs headline.

Affected Entities and Sector Exposure

More than 70 U.S. companies were identified as being affected by these North Korean remote IT worker schemes. The Justice Department did not name specific victims in the provided material. The high number of affected entities indicates a broad exposure. The source material does not specify which industries were targeted or provide details on the nature of the work performed by these individuals.

The use of stolen U.S. identities allowed these workers to pose as legitimate employees, according to the Security Affairs headline. This deception is central to the schemes described. The fact that these schemes operated remotely is noted in the Justice Department’s announcement. The source material does not discuss the challenges of detection or the specific security tools used by affected companies.

What should you do?

Security teams should review their remote workforce management protocols to ensure strict identity verification processes. Organizations must verify the legitimacy of all remote employees, particularly those hired through third-party vendors or agencies. Monitoring for unusual access patterns or data transfers can help identify potential compromises early.

What to do and how to stay safe: North Korea

Audit remote employee onboarding processes to verify identities and employment history thoroughly.
Implement multi-factor authentication for all remote access points to prevent unauthorized entry.
Monitor network traffic for anomalies that may indicate data exfiltration or unusual access patterns.
Review vendor and third-party contractor agreements to ensure compliance with identity verification standards.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.