North Korean Hiring Fraud

This is employment fraud, not phishing

Most descriptions of this threat get the mechanics wrong. The fraudulent candidate does not want an upfront fee and does not send you a malicious link. They want the job. DPRK IT workers apply for remote software, DevOps and IT support roles under identities that are stolen, borrowed or built from scratch. AI does the heavy lifting at every stage: CVs tuned to the job description, LinkedIn profiles with plausible histories, cover letters in fluent business English, and real-time coaching or face-swap tooling during video interviews.

Once hired, the operative works. Sometimes well. Salaries flow back to the regime, which is the primary objective and the reason the US Treasury and Department of Justice treat this as sanctions evasion rather than ordinary cybercrime. The secondary objective is access. A hired developer holds credentials, source code, cloud consoles and internal documentation legitimately, with no exploit required. In documented cases, terminated operatives have exfiltrated data on the way out and extorted the employer afterwards.

The KnowBe4 case is worth knowing because the company published the full account itself. A security awareness vendor hired a remote software engineer who passed four video interviews and a background check. The identity was real but stolen; the photo was AI-modified. What caught the operative was not HR screening but endpoint telemetry: malware activity on the corporate laptop within minutes of first use. That is the honest lesson of the whole scheme. Detection lives in your security stack, not in your interview process.

How a US laptop farm actually works

The laptop farm solves the geography problem. Your new hire claims to live in the United States, so you ship the corporate laptop to a US address. That address belongs to a facilitator, a paid accomplice who plugs the machine in, keeps it online and installs remote access software or an IP-based KVM switch. The actual worker connects from abroad, often from China or Russia, and drives the laptop as if sitting in front of it.

From your side, everything checks out. The device is corporate-issued and MDM-enrolled. The IP is residential American broadband. Conditional access sees a compliant device in an expected country. Geolocation alerts stay quiet. US Department of Justice prosecutions have described single households hosting dozens of corporate laptops at once, each labelled with the company and the assumed identity it served, which tells you how industrialised the model has become.

This is why the laptop farm defeats controls that look strong on paper. Impossible-travel detection, country blocking and device compliance all validate the machine, not the human behind it. The gap between those two things is the entire scheme.

Why UAE businesses are in scope

The scheme follows remote hiring, and UAE tech hiring is remote-friendly by design. Fintech and crypto firms recruiting out of DIFC and ADGM hire developers globally, pay well, and in Web3 sometimes pay in crypto, which removes the banking checks that might otherwise flag a name mismatch on the receiving account. Contractor and employer-of-record arrangements are common in the UAE job market, and they diffuse responsibility for identity verification until nobody actually owns it.

There is also a reverse variant, and it targets your existing staff rather than your vacancies. DPRK groups run fake recruiter operations: a convincing approach on LinkedIn, an attractive offer, then a coding assessment or interview app that is malware. Developers at crypto and financial firms are the preferred targets because their workstations hold wallet keys, deployment credentials and production access. If your engineers receive unsolicited offers regularly, and in the UAE market they do, this is a live path into your environment that HR never sees.

Both variants fit the same definition: someone impersonating a participant in your hiring process to get inside. Only the direction differs.

The signals that actually catch them

Hiring-stage signals are behavioural, and recruiters can learn them faster than any tool can:

• Camera reluctance, or a camera that fails only during identity checks. Ask for something spontaneous on video; face-swap tooling degrades under movement and unscripted requests.
• A shipping address that does not match the stated residence, or a request to redirect the laptop after dispatch. Treat a redirect as an incident, not an inconvenience.
• Payment detail changes shortly after onboarding, VoIP-only phone numbers, and references that only ever respond in writing.
• A CV that mirrors the vacancy too precisely. AI-generated applications track the job description more tightly than real careers ever do.

Technical signals appear after onboarding, and they are the reliable ones:

• Remote access tools on a new hire's machine. AnyDesk, TeamViewer or a USB device presenting as a KVM has no business on a corporate laptop in week one. Your MDM should block the install and your EDR should alert on the attempt.
• Sessions that never sleep, mouse-jiggler patterns, and working hours inconsistent with the claimed time zone. This is exactly the anomaly class that user and entity behaviour analytics exists to surface: a baseline forms within weeks, and a remote operator working Pyongyang-friendly hours against a claimed US residence deviates from it quickly.
• Early, broad reconnaissance of repositories and internal documentation well beyond the assigned role.

Constrain the blast radius while confidence builds. A new remote hire does not need production secrets, customer data or standing admin rights in their first quarter. Broker anything privileged through privileged access management with session recording, and keep the identity on least privilege until verification has done its work.

An onboarding gate that closes the gap

The fix is a sequence, not a product. Run every remote technical hire through this gate:

1. Verify identity documents live on camera, held by the person, matched to the face in motion. An emailed scan verifies nothing.
2. Ship equipment only to the address on the verified documents. Any redirect request goes to security, not to the courier.
3. Enforce device policy from first boot: no unapproved remote access software, alerts on install attempts, unknown USB devices blocked.
4. Keep the first 90 days on least privilege. No production credentials, no customer data exports, privileged actions brokered and recorded.
5. Review first-month telemetry deliberately: login geography, device fingerprints, session patterns, and working hours against the claimed location.
6. Train recruiters and hiring managers on this specific scheme. Security awareness programmes usually stop at phishing; extend yours to the hiring pipeline, because recruiters see the first signals and currently have no reason to escalate them.

If you conclude you have already hired one, treat it as an incident from the first minute. Preserve the laptop, the emails and the payment records, cut access before the termination conversation, and report through the Dubai Police eCrime platform or your emirate's equivalent channel. The employment file is evidence, and in documented cases the extortion attempt follows the termination, not the discovery.