The National Security Risk Hiding in Your Remote Workforce
July 25th, 2025
❓What:
Between October 2020 and October 2023, North Korean state-sponsored actors posed as U.S. based IT workers and were able to infiltrate over 300 U.S. companies, including Fortune 500 firms, a major TV network, an aerospace manufacturer, and Nike.
This was made possible in part by Arizona woman, Christina Marie Chapman, whose house was found to have 90 laptops that the actors were able to operate remotely from North Korea. Consequently, she was sentenced to 102 months (8½ years) in federal prison today.
The operation generated more than $17 million in illicit revenue for the North Korean regime. Chapman earned approximately $176–177K, and was ordered to forfeit $284K and pay a $175K–$176K fine.
⚠️Impact:
Demonstrates serious national security risk: Adversaries exploiting remote work trends and stolen identities to embed within U.S. corporate networks
Highlights systemic vulnerabilities: Remote hiring without identity proof allowed foreign operatives access to corporate systems, with potential for data theft, extortion, and espionage.
Part of a larger scheme: DOJ previously dismantled at least 29 laptop farms across 16 states, seizing hundreds of devices and financial accounts tied to North Korean revenue generation schemes totaling hundreds of millions annually.
💡Recommendations:
Strengthen remote-hiring identity verification: Use robust proofing measures—biometric checks, supervised on-boarding, and thorough background validation.
Monitor on-boarding infrastructure: Track where company devices are shipped; flag unusual clusters or foreign re-routing.
Conduct periodic audits of remote access logs, especially for high-risk roles or unusual login patterns from offshore IP addresses.
Leverage threat intelligence feeds: Be diligent in staying up to date with security advisories from the DoJ, FBI, and cybersecurity firms around IT outsourcing scams.
Train HR and security teams: Train personnel to recognize fake identities, deepfake-driven resumes, and the rise of “laptop farm” operations enabling remote workers who aren't physically in the U.S.
Verify the reputability of third-party vendors and outsourced entities: Ensure partners undergo security assessments, contractually enforce secure access policies, and verify employee locations and identities.
Read the full article HERE
Watch this YouTube video covering DPRK IT scams more in depth