Suspected North Korean IT worker on your payroll: a signal matrix and a removal order for IT, HR and legal

A company that suspects one of its remote engineers is a North Korean IT worker should treat it as a short, scoped investigation followed by one coordinated removal, not a slow watch and not an immediate firing. The FBI says these workers cannot be identified reliably with a single indicator, so the work is pooling what IT, HR, payroll and security each see, preserving evidence within hours, revoking access in one window, and calling the FBI and counsel before the worker is told.

This guide is for a security lead working with HR, payroll and counsel. It assumes the person already has an account, a laptop and a paycheck. "Suspected" is the right word throughout: North Korea is the FBI's attribution for the scheme, not a finding about any one employee, and Microsoft notes that a positive identification of a remote worker on its criteria does not guarantee that the worker is North Korean. Signals start a review. They never justify action based on nationality, name, accent or country of education; the FBI warns that relying solely on ban lists or name filtering can be unreliable and that aggressive controls risk false positives that harm legitimate employees.

Which signals matter, in which system, and who sees them?

Use behavior and technical signals only, and treat each as a reason to look closer. The FBI says the indicators may be innocuous individually but, when considered together, are "highly suggestive" of malicious activity. The "where it shows", "who sees it" and "weight" columns are our mapping; the signals themselves come from the FBI unless noted.

No team holds more than a few rows. The FBI says IT, HR, security and management each have "unique insights that when combined" work better, so route every signal to one named case owner. Counsel should know the case exists from the start, because the people-side findings (payroll, interviews) feed legal decisions.

A defensive AI agent can help with the mechanical part: joining sign-in countries, software inventory and payroll changes for a named account into one timeline. It needs read-only access to those logs and nothing else. A human should decide whether the timeline opens a case, because a wrong match lands on a real employee.

How do you investigate without tipping them off?

Keep it to hours or days. The FBI's January 2025 advisory recommends that a company that suspects a North Korean IT worker capture activity on the suspected device, but the FBI also says these workers "almost always exfiltrate data", and the September 18, 2026 joint advisory it co-issued says to promptly revoke accounts and sessions once a subcontractor is possibly a North Korean IT worker. Every extra day of watching is another day of copying. Counsel sets how long covert monitoring may run and what notice it needs under your state's monitoring law.

Within the first day:

1. Limit the circle. Microsoft advises a small, trusted insider-risk group trained in operational security, to avoid tipping off the subject and collaborators. Our version: security lead, one HR partner, one payroll contact, counsel. No manager of the worker, no team chat.
2. Pull what the FBI says to watch. Network logs and browser-session activity for exfiltration through shared drives, cloud accounts and private code repositories; the assigned device's network activity; sign-in IPs and countries; the payroll and address change history; company repositories copied to personal profiles and personal cloud accounts. Add clones and forks from your Git audit log.
3. Check for session theft. The FBI notes these workers may harvest credentials and session cookies to start work sessions from non-company devices, so look for sessions from unmanaged devices.
4. Sweep for other personas. Microsoft says to detect relationships with collaborators and other aliases run by the same actor before acting, and to avoid premature action that might alert them. The FBI says to compare payment accounts of all employees for matching banking information, and the July 2026 multinational alert says an account may be operated by several people. Search the whole workforce and your staffing firm's workers for shared bank accounts, IPs, phone numbers, emails and device indicators. One case should become a sweep, not a single removal.

Verify the quiet phase is done when the case owner can answer, in writing: what the person can reach, what has left, which other identities share indicators, and which apps hold their own sessions or keys.

In what order do you remove a suspected worker?

Scope and preserve first, revoke in one window, recover the device, then give notice. Microsoft publishes the elements of a removal: a small need-to-know group, link analysis for aliases, avoiding premature action, evidence preservation and a post-removal forensic sweep. The numbered order, the owners and the before-or-after-notice column below are our analysis. The FBI's advisories give no removal order.

Revocation, step 7, is where a quiet plan fails. Revoking at the identity provider does not end app sessions: Microsoft's documentation says Entra ID cannot directly revoke a session token an application issued, so each app must revoke its own, and access tokens last 1 hour by default. Plan for up to 1 hour of residual access and watch that account until it passes. For tokens and grants that outlive a password reset, see the SaaS access review guide.

On GitHub, removing a member can leave local copies on the person's machine, and users may retain access to private forks held by other organizations. That is why step 3 comes first: the fork list tells you where code may already sit.

Case handling around these steps follows the incident response plan guide.

How do you get the laptop back, or handle it if it never comes?

We recommend capturing forensic evidence remotely before any wipe, then isolating the device through MDM. The FBI asks reporters for any street address that received an employment device, which means the shipping address is evidence for the FBI, not a place to send staff. Facilitators paid by these workers have made in-person threats against companies that removed related accounts, so do not send anyone, including a courier or a manager, without the FBI's input. If the laptop never returns, record it as lost, wipe only after the evidence copy is verified, and rotate every secret that was on it. DOJ's June 30, 2025 release says that, according to court documents, the schemes it describes obtained employment with more than 100 US companies, and that FBI searches of 21 known or suspected laptop farms between June 10 and June 17, 2025 seized approximately 137 laptops. DOJ notes that the details in those court documents are merely allegations.

Who reports what to whom?

Report to your local FBI field office and file an IC3 complaint, as quickly as possible. The FBI's tip line is 1-800-CALL-FBI. The October 2026 advisory lists what to include: the address that received the device, personal identifiers (names, social media accounts, phone numbers, emails, bank accounts, IP addresses), images, screenshots, videos and messages, and any details on facilitators. If a staffing firm placed the worker, tell the firm; the FBI's July 2025 advisory says contract IT work is a common way these workers get hired and asks companies to educate the third party.

Counsel owns the sanctions question. Treasury's October 28, 2026 release says OFAC may impose civil penalties for sanctions violations on a strict liability basis. The July 31, 2026 multinational alert says contracting with North Korean IT workers and paying them for services rendered may violate the domestic laws of many countries, including the United States. OFAC's Enforcement Guidelines (31 CFR part 501, Appendix A) say that notification of an apparent violation to another government agency (but not to OFAC) by a Subject Person (an individual or entity subject to OFAC's sanctions programs), which that agency considers a voluntary self-disclosure, may be considered a voluntary self-disclosure by OFAC, based on a case-by-case assessment. A voluntary self-disclosure lowers the base penalty: in a non-egregious case it is one-half of the transaction value, capped per violation, and in an egregious case one-half of the statutory maximum. Whether to disclose and what to do with pay still owed are for counsel; Holland & Knight suggests consulting counsel before post-discovery payments and considering blocking or escrowing amounts payable to a sanctioned person.

What if the worker demands money or makes threats?

Expect it. The FBI reports that after discovery these workers have held stolen proprietary data and code hostage until companies meet demands, and in some cases publicly released code. After termination, the October 2026 advisory says, they have made death threats against former managers and their families, and facilitators have made in-person threats against companies that removed accounts. Holland & Knight adds that fraudulent workers may exploit wage-payment statutes or frame extortion demands as severance.

We recommend that security never answer a demand or negotiate alone. Route every message to the case owner, preserve it, and bring in the FBI and counsel before any reply. A payment is also a sanctions question (see above). Brief the managers involved once access is revoked and before notice, tell them not to engage, and if anyone receives a threat to life or is concerned about physical safety, call 911, as the FBI instructs.

What should change afterward?

Turn the signals into standing controls.

• Block unapproved remote-management tools. Microsoft suggests Windows Defender Application Control or AppLocker policies for this.
• Disable local administrator accounts and limit privileges for installing remote desktop applications, per the FBI's least-privilege advice.
• Alert on multi-country sign-ins and KVM-over-IP or unexpected remote-control software in inventory. Note that a silent endpoint agent can hide these signals, as in the fake coding test case.
• Review payroll changes: bank and address changes, third-party account names, matching details across staff.
• Sweep every system the worker touched for persistence, as in step 10.
• Expect re-application under new identities. Holland & Knight says to anticipate that suspected operatives will try to re-infiltrate.

Strong MFA does not fix this: it proves the account holder is present, and here the account holder is the impostor (phishing-resistant MFA). The hiring-side controls, including interview checks and verifying the person at each stage, are in the hiring section of our call-back verification guide. Deepfakes matter at that step; after hire, the controls above are ordinary ones. Run the same signals past HR before acting on any one person, because the FBI's warning about false positives applies to your own employees first.