Proactively Defending Financial Institutions Against North Korean Remote IT Workers
What’s in the Silent Push report on North Korean remote IT workers?
This report follows a North Korean recruiting scheme that Silent Push found on a Discord server, where a recruiter offered U.S., E.U., and Latin American citizens 35% of a salary to act as the face and the legal identity on job applications.
The remaining 65% goes back to the North Korean worker through cryptocurrency, wire transfers, or third-party payment processors. The report explains why the scheme passes document-based KYC and AML checks, shows how connection origin data exposes it, and sets out the indicators HR, fraud, and cybersecurity teams can use to spot a North Korean IT worker before onboarding.
Access below:
Frequently asked questions
What is a North Korean remote IT worker scheme?
North Korean operatives apply for remote technical roles using stolen, rented, or borrowed identities, often with a Western or Latin American citizen acting as the face on camera and the name on the contract. The salary is paid into a domestic account and then moved back to the operator. In June 2025, the U.S. Department of Justice announced coordinated actions across 16 states and found that workers had obtained employment with more than 100 U.S. companies.
Why do North Korean IT workers pass KYC and AML checks?
Document-based KYC and AML checks confirm that an identity is real and that the documents match. In this scheme the identity is legitimate and the connection arrives from a clean domestic residential IP address, so both checks pass. The operator sits upstream of that address, behind a residential proxy or a KVM-over-IP relay in a laptop farm.
How can a financial institution detect a North Korean IT worker before onboarding?
Check where an applicant’s connection starts rather than the final residential hop, treat early requests to move salary to an EMI or third-party account as a sanctions and money laundering signal, train recruiters on interview and employment anomalies, and agree which applicant fields HR passes to the cybersecurity team and when. The report sets out each handoff and a named owner for it.
