A job posting that asks a stranger to receive a work laptop and keep it running at home can turn an ordinary person into a cog in a North Korean revenue scheme. The FBI warned on Oct. 13, 2026 that the government in Pyongyang is expanding its use of paid facilitators, many of them Americans, and widening its recruitment to people who have never heard of the operation.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one free daily email from TLDR.
We may earn a commission if you sign up.
The bureau estimates that North Korea receives 85 to 90 percent of the revenue its remote workers generate, and it describes thousands of state-controlled workers organized into dozens of teams. A person who agrees to host a device is not the visible face of that machine, which is what makes the role attractive to the organizers and risky for the recruit, who may not realize what the arrangement supports until investigators arrive.
How facilitators and laptop farms work
According to the FBI’s public service announcement, North Korea uses remote IT workers to infiltrate Western companies while evading detection, relying on stolen identities, extortion and threats of violence, and the bureau says their earnings fund the country’s weapons programs. The workers increasingly depend on facilitators to pass identity checks and keep jobs. Facilitators may appear on camera, interview for positions, verify identities, share social media accounts, ship packages, or host work devices in what investigators call laptop farms, often inside an ordinary home.
The workers also recruit well beyond the United States. The announcement says some subcontract work to freelancers in Pakistan, India, Nigeria and neighboring countries, and that they target people under financial stress. They buy verification accounts to clear background checks, impersonate others and go after jobs that require security clearances. After being fired, they have made death threats, threatened to leak data and sent facilitators to intimidate victims in person.
Cases that show the stakes
A Justice Department case shows how a facilitator’s role plays out. Minh Phuong Ngoc Vong of Bowie, Maryland, obtained remote software jobs at U.S. companies with false claims about his education and experience, then let a co-conspirator in Shenyang, China, use his credentials to do the work. Prosecutors said that person was likely a North Korean national generating revenue for the government. Vong pleaded guilty to conspiracy to commit wire fraud and, as the department announced in December 2025, was sentenced to 15 months in prison followed by three years of supervised release. He held jobs at at least 13 companies, which paid him more than $970,000.
The Vong filing shows how mundane the mechanics can look. A resume submitted in his name to a Virginia technology company on Jan. 30, 2023 falsely claimed a bachelor’s degree and 16 years of software experience, and on March 28, 2023 he passed an online interview with the company’s chief executive, verifying his identity with a Maryland driver’s license and a U.S. passport. He was assigned to a Federal Aviation Administration contract, and he installed remote access software on the company laptop so the co-conspirator could work while concealing a location in China. Several of the companies that employed him subcontracted his services to government agencies.
The scale of laptop farms was laid out in June 2025, when the Justice Department announced coordinated nationwide actions against North Korean remote workers. The FBI searched 21 premises across 14 states that hosted known or suspected laptop farms and seized about 137 laptops, and prosecutors said North Korean workers had obtained jobs at more than 100 U.S. companies using the stolen or fake identities of more than 80 U.S. persons. The Massachusetts scheme alone generated over $5 million in revenue, and facilitators received at least $696,000.
Warning signs and where to report
For individuals, the guidance is short. The bureau advises caution about freelance or job postings that ask a person to interview for someone else or to receive and host laptops, skepticism toward elaborate backstories and official-looking documents, and refusal of any request for personal, financial or account login information in exchange for payment. Anyone who receives a threat to life or safety is told to call 911.
Employers get a longer list of indicators: remote desktop or monitoring software such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop or Splashtop; KVM-over-IP devices such as TinyPilot, PiKVM or GL.iNet; unrelated software like OBS Studio with a VDO.Ninja plugin on work machines; screen recordings stored on personal devices; and frequent changes to bank accounts, addresses or social media. No single sign is reliable, so the FBI recommends an approach it calls identity in depth, layering controls and verification across the whole employment lifecycle and aggregating weak signals before a closer review. It cautions that aggressive controls and blanket ban lists can block qualified applicants and harm identity-theft victims.
Reports go to a local FBI field office or through a complaint filed with the Internet Crime Complaint Center. Useful details include street addresses tied to the activity, names, accounts, phone numbers, emails, bank accounts and IP addresses, images or messages identifying the actor, and information on facilitators.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
