October 20, 2026 | 1:00–2:00 PM EST
Disarming DPRK’s Cyber Syndicate & Hidden IT Workforce
A Special Presentation of InfraGard National’s Insider Threat Cross Sector Council
North Korea’s cyber program has grown into a global revenue operation that reaches well past intrusion and theft. Alongside its hacking units, the regime runs thousands of fraudulent remote IT workers who secure jobs at companies around the world, supported by a network of facilitators who supply identities, laptop farms, and payment channels, and increasingly by AI tools that help these workers pass interviews and sustain false personas. Once inside, they collect salaries that fund state objectives, and some go on to access sensitive systems, steal data, or extort their employers. Michael Barnhart, an i3 Investigator with the Nation-State and Criminal Insider Intelligence and Reporting arm of DTEX, draws on current intelligence to explain how these operations infiltrate organizations and evade detection. Michael previously served as Head of DPRK Operations at Mandiant/Google Cloud, where he led teams tracking North Korea’s evolving cyber activity, and he brings more than two decades of experience in threat intelligence, counterterrorism, and nation-state operations.
The session examines how DPRK workers move through hiring, onboarding, and day-to-day employment without raising alarms, and why the risk often lands on human resources and hiring managers before it ever reaches the security team. Attendees will learn the behavioral and technical indicators that most often expose these workers, the gaps in identity verification and remote access that facilitators exploit, and practical steps for screening candidates, monitoring for anomalous activity, and responding when a suspected DPRK insider is discovered.
Click to register
On behalf of the FBI Cyber Division, the Office of Private Sector is sharing a newly released Public Service Announcement titled “North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment.” The PSA is available here.
North Korea continues to adapt its tactics to place state‐directed IT Workers (ITWs) inside Western companies. These actors generate revenue for the regime, exfiltrate data, and conduct other malicious activities while posing as legitimate remote employees.
To evade improved corporate screening and law enforcement action, North Korean ITWs are increasingly using U.S.-based facilitators, expanding recruitment of Americans, and subcontracting work to third-party foreign nationals.
Because this threat is persistent and rapidly evolving, organizations are encouraged to adopt an “identity in depth” approach including layered identity and access controls applied throughout the employment lifecycle to detect and remove illicit ITWs despite changing tactics.
If you, your company, or someone you know has fallen victim to North Korean ITW activity or has been approached or contacted by a possible ITW, contact your local FBI Field Office and file an IC3 complaint at www.ic3.gov. For more on the North Korean cyber threat visit the FBI Cyber Division's website.
Jesse Jones
National Programs Manager
InfraGard National Members Alliance