In 2025 the US sanctioned North Korean fronts that place fake IT workers abroad, and a US laptop farm operator got 102 months. How the scheme works.
Social Engineering Examples·7 sources
North Korean IT workers get hired at foreign companies using fake identities, and the wages fund Pyongyang's weapons programs. In 2025 the US Treasury went after the networks behind them. On 16 January, its Office of Foreign Assets Control (OFAC) sanctioned a North Korean defence ministry unit, Department 53, two front companies and a Chinese hardware supplier. On 24 July it sanctioned a second front company. The same week, Arizona's Christina Chapman was sentenced to 102 months for running a US "laptop farm" for these workers. Status: Sanctions in force; Chapman sentenced.
| Date | Action |
|---|---|
| 16 January 2025 | OFAC designates Department 53 (under North Korea's defence ministry), front companies Korea Osong Shipping Co. and Chonsurim Trading Corp., China-based Liaoning China Trade Industry Co., and two individuals. Delegations had worked from Laos since at least 2021 to 2022 |
| 23 July 2025 | FBI public service announcement on IT worker tactics |
| 24 July 2025 | OFAC designates Korea Sobaeksu Trading Co. (Sobaeksu United Corp.), a front for the Munitions Industry Department, and three individuals, for sending teams to countries including Vietnam. The State Department offers up to $3 million each for information on two of them |
| 24 July 2025 | Christina Chapman sentenced to 102 months in prison |
| 12 March 2026 | Treasury takes a related action against six individuals and two entities, including associates of one July designee |
The individuals sanctioned haven't been convicted of anything in a US court, so they aren't named here. Treasury and the Justice Department describe the foreign fronts and the domestic helpers as two halves of one state revenue scheme.
| Piece | What it does |
|---|---|
| The worker | Applies for remote IT or software jobs worldwide, using false or stolen identity documents |
| The front company | Organises and deploys the teams abroad for a North Korean state body |
| The supplier | Liaoning China Trade provided computers, graphics cards, HDMI cables and network gear |
| The laptop farm | Company laptops are shipped to a US home, where a facilitator keeps them running so workers abroad can log in remotely |
| The payroll | Wages flow through accounts the facilitator controls, then onward |
What gave Chapman's operation away? Stacks of company laptops in one house. Remote-access kit. The same stolen names turning up again and again. Someone else running the payroll.
Tip: new hire wants the laptop sent somewhere other than the address on file? Ask why before it ships.
| Figure | What it covers |
|---|---|
| More than $17 million | Revenue from the Chapman-facilitated scheme alone, per the Justice Department |
| Hundreds of millions a year | Treasury's estimate for the whole North Korean IT worker program |
| Nearly $800 million | Treasury's March 2026 figure for 2024 IT worker revenue |
Keep these apart. The big program-wide numbers are Treasury estimates, and nobody has tied them to the particular networks named in January and July 2025.
See also the KnowBe4 fake IT worker, the Massachusetts laptop farm case and synthetic identity.
North Korean nationals who get remote tech jobs at foreign companies using fake or stolen identities. Treasury says their wages fund the regime's weapons programs.
Department 53, front companies Korea Osong Shipping, Chonsurim Trading and Korea Sobaeksu Trading, Chinese supplier Liaoning China Trade Industry, and five individuals.
A home in the US where company laptops are kept switched on so overseas workers can log in remotely and appear to be US-based.
She was sentenced to 102 months in prison in July 2025 for running a laptop farm that placed North Korean workers at 309 US companies.
Social Engineering Examples. “OFAC sanctions North Korean IT worker front companies (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/dprk-it-worker-front-company-ofac-sanctions-2025
DPRK IT-worker operations typically begin by acquiring or purchasing stolen or borrowed U.S. persons' identity documents (Social Security numbers, IDs) and building supporting personas, resumes, and job-platform/social-media accounts, consistent with DOJ's description of the Chapman scheme using 68 stolen American identities and the FBI's guidance on facilitators creating job-search-site accounts on the workers' behalf.
stolen-identity documents are hard to distinguish from genuine ones at the application stage because the underlying SSNs and IDs are real; the practical control is rigorous background-check cross-referencing against known-compromised-identity databases and notarized or in-person identity verification before an offer is extended, rather than trusting document appearance alone.
operators typically recruit or pay U.S.-based (or China-, UAE-, or Taiwan-based) collaborators, witting or unwitting, to act as facilitators, per the FBI's July 2025 PSA and DOJ's June 2025 coordinated-actions announcement describing facilitators who receive devices, set up front businesses, and attend interviews on the workers' behalf.
facilitator recruitment happens outside the employer's visibility (gig networks, encrypted channels), so it is not directly defensible at the employer level; the nearest practical control sits at Stage 4, where shipping-address and equipment-geolocation checks expose a facilitator once a company laptop is actually dispatched.
fake personas apply to remote IT/software roles using falsified identity credentials. Broader FBI guidance describes facilitators creating job-search-site accounts and supporting interviews, but the supplied Treasury windows do not establish AI face-swapping or AI-generated resumes for these named networks.
employers should independently verify remote candidates' identities and claimed locations rather than treating a single remote interview as conclusive.
once hired, the employer-issued laptop is shipped to the facilitator's residential address (a "laptop farm"), where the facilitator installs KVM switches and remote-desktop/VPN software so the DPRK worker can operate the machine from overseas while appearing to log in from a domestic residential IP, per DOJ and FBI descriptions of Chapman's and other facilitators' operations.
requiring that company equipment only ship to the address on file in verified identity documents, monitoring for KVM-switch or unauthorized remote-desktop software installation, and flagging logins from residential IP ranges inconsistent with the claimed employee's location directly targets the laptop-farm infrastructure.
the DPRK worker performs the job, in some documented cases swapping the person behind a single persona, while paychecks are routed via direct deposit, crypto, or facilitator-controlled bank accounts, consistent with DOJ's description of Chapman receiving and forging payroll checks in stolen identities' names.
ongoing verification during employment, periodic re-capture and comparison of employee photos or video, and monitoring for behavioral or timezone inconsistencies can catch worker-swapping and non-local work patterns after hire.
the named DPRK front companies employed or represented overseas IT-worker teams that generated revenue, while Liaoning China Trade supplied Department 53 with computers, graphics cards, HDMI cables, and network equipment used for overseas IT-worker activity.
payroll and banking anomaly detection, such as flagging multiple "different" employees who share a bank account, routing number, or facilitator-controlled deposit account, plus financial institutions' standard AML/KYC monitoring of rapid international transfers, targets the laundering step directly.
the DPRK government withholds up to 90% of the wages according to Treasury, funneling the proceeds, an estimated hundreds of millions of dollars annually across the wider program, to the Ministry of National Defense/Department 53 and the Munitions Industry Department to fund weapons, nuclear, and ballistic-missile programs.
OFAC/SDN sanctions designations and asset-blocking, the Treasury actions this case documents, are the systemic backstop, cutting the named front companies and individuals off from the U.S. financial system once earlier controls fail, though enforcement reach is limited for actors operating entirely outside U.S. jurisdiction in North Korea, Laos, China, and Vietnam.
Browse by what this case has in common with others in the library.
Someone used the White House chief of staff's phone contacts and an AI-like voice to call senators and executives, asking…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Toronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The…
Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
In 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was…
OpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to…
Air Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from…
A Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title…
Impostors posing as Scoular's CEO and a senior figure at its audit firm convinced the controller a secret China acquisition…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
A nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives, first through a recruited…
A '2011 Recruitment Plan' email with a booby-trapped Excel file breached RSA in 2011. SecurID data was stolen and later…
An attack attributed to Russia's Sandworm Team used compromised credentials to remotely open substation breakers at three Ukrainian utilities and…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Lazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M…
Social Engineering Examples