North Korea Earned $3M by Infiltrating 70+ US Firms With Stolen Identities

The Justice Department announced coordinated actions to combat North Korean remote IT worker schemes that affected more than 70 U.S. companies. According to the Department of Justice, these operations used stolen U.S. identities to infiltrate corporate networks. The schemes reportedly earned roughly $3 million by embedding workers into American firms. This disclosure highlights how state-sponsored actors can leverage identity theft to establish long-term access within target organizations.

In plain English

North Korean actors created fake U.S. identities to pose as legitimate IT workers. By presenting themselves as trusted employees, they gained entry into more than 70 American companies. This approach allowed them to operate inside corporate environments without raising immediate suspicion. The goal was to maintain persistent access while generating illicit revenue. Teams must recognize that identity fraud can bypass traditional perimeter defenses entirely.

The background

The Department of Justice released this information as part of a broader crackdown on cyber-enabled crimes. The announcement specifically addresses schemes that hide behind stolen U.S. identities to infiltrate corporate structures. According to the Justice Department, these actions target North Korean remote IT worker networks. The scale of the operation, affecting over 70 firms, indicates a systematic approach to recruitment and infiltration.

What changes now

Security operations teams should review their remote worker onboarding processes for signs of identity fraud. The Justice Department’s announcement signals increased scrutiny on these types of infiltration schemes. Companies affected may face new compliance requirements or investigations. Organizations must assume that stolen identities can be used to gain legitimate-looking access to internal systems.

What made it possible

Teams usually rely on identity verification during hiring to prevent unauthorized access. This incident shows how stolen credentials can bypass those checks. The weakness lies in trusting presented identity documents without deeper validation. Attackers exploit the gap between initial onboarding and ongoing verification. Security teams should check whether their processes validate identity continuously, not just at entry. This gap allows malicious actors to embed themselves within trusted networks for extended periods.

Background: Identity theft

Secure identity theft prevention requires isolating credentials, hardening recovery channels, and monitoring financial footprints. Use this checklist to implement technical controls that reduce the attack surface for identity fraud and limit the damage of any single compromised account.

Read the full guide: Identity Theft Prevention Checklist for Technical Users

What to do and how to stay safe: North Korea

• Review remote employee onboarding procedures for robust identity verification steps.
• Monitor for unusual access patterns from new or remote workers.
• Verify the authenticity of identity documents provided during hiring.
• Once the vendor provides an update, apply patches to identity management systems.

Step-by-step guide: Indicators of Compromise Examples and How to Use Them

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many companies were affected by these North Korean schemes?

More than 70 U.S. companies were affected, according to the Department of Justice.

What did the attackers use to infiltrate these companies?

They used stolen U.S. identities to pose as remote IT workers.

How much money did these schemes generate?

The schemes reportedly earned approximately $3 million.