Threat actors linked to the Democratic People’s Republic of Korea (DPRK), also known as North Korea, are reportedly seeking employment beyond the information technology sector. Recent investigations have identified suspected North Korean workers holding positions in sales, marketing, and the medical field. These schemes may allow operatives to earn revenue, access sensitive information, or establish a foothold inside targeted organizations.
The expansion into nontechnical professions demonstrates that fraudulent employment schemes are no longer exclusively an IT security concern. Employees working in marketing, sales, healthcare, and other departments may still access customer records, confidential business strategies, internal communications, and financial information. Organizations that unknowingly hire sanctioned workers could also face legal, financial, regulatory, and reputational consequences.
Employers should strengthen identity verification throughout the hiring process, particularly for remote positions. Precautions should include live video interviews, government-issued identification checks, employment and education verification, and screening for inconsistencies in résumés, locations, phone numbers, and banking details. Companies should also watch for candidates who avoid appearing on camera, use multiple identities, rely heavily on scripted answers, or request that corporate devices be shipped to an unusual address.
After hiring, organizations should apply least-privilege access, require multifactor authentication, monitor unusual login locations, and restrict access to sensitive systems until an employee’s identity is fully verified. Company laptops should only be shipped directly to confirmed employees, not third-party “laptop farms.” HR, security, and legal teams should work together to investigate warning signs and promptly report suspected fraudulent employment activity to the appropriate authorities.