FBI Warns North Korean IT-Worker Infiltration Is Expanding Beyond Laptop Farms

The FBI issued a new warning on October 13, 2026: North Korean remote IT workers are broadening their use of paid facilitators and third-party labor to infiltrate western companies. The same day, DOJ announced charges against 14 people, two arrests and approximately 187 seized computer devices in related enforcement actions. ## Affected systems The exposure is employer-issued computers, corporate accounts and the systems accessible through remote IT jobs—not a particular software version. DOJ says the charged Ohio scheme affected more than 70 U.S. employers across healthcare, communications, cyber support, retail and manufacturing. ## Access path Prosecutors allege workers obtained jobs using stolen or fabricated identities and U.S.-based facilitators hosting employer laptops. The FBI's broader warning says facilitation now extends beyond device hosting into identity and recruitment support. This turns seemingly legitimate employment access into an insider-security problem. ## Impact The Ohio indictment alleges a scheme running from 2019 into approximately July 2025 that generated about $3 million. Those figures belong to that case, not the entire global threat. Separately, the FBI reports data theft, extortion and threats of physical violence in the wider IT-worker activity. The advisory does not establish that every charged employer suffered all those outcomes. ## Mitigations The FBI recommends layered identity verification and access controls throughout employment, with HR, IT, security and management sharing relevant findings. Review combinations of suspicious behavior rather than relying on one name, nationality, application or remote-work signal. Calibrate detections carefully: aggressive filtering can harm legitimate employees and identity-theft victims. Report suspected activity to IC3 and the local FBI field office. ## Uncertainty The charges remain allegations; defendants are presumed innocent. The newly disclosed warning and enforcement actions are not evidence that all underlying activity began this week. Public sources do not provide a complete victim list or quantify data losses across the more-than-70-employer case.