frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

Open in hackernews

The North Korean fake IT worker problem is ubiquitous

https://www.theregister.com/2025/07/13/fake_it_worker_problem/
80•rntn•5h ago

Comments

anovikov•5h ago
You don't have to be an evil North Korean to do that. Outsources have been doing it since time immemorial because they can't achieve sales in any other way (or, through direct corruption - often offshore outsourcing shops are owned by managers of their clients, who effectively use them as tools for siphoning money away).
gibbitz•4h ago
Hopefully the fear of foreign actors will put an end to this too.

I have to hand it to North Korea on the inventive revenue streams. This is a country under sanctions for decades that has developed some of the most clever IT scams for siphoning money from the west. Between this and the Lazarus group the country has brought in Fortune 500 company kinds of money to keep itself afloat.

abxyz•4h ago
The supposed problem is being peddled by a company called Socure, who, coincidentally, offer the solution to this problem. There are absolutely "fake" remote workers floating around but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence. "North Korean" job applicants has become a meme, any suspicious looking applicant is being labelled "North Korean" by people who've read articles planted by Socure. If this were a grand North Korean government orchestrated conspiracy we would not see hundreds of job applicants engaging in exactly the same strategy for the same job.

https://www.socure.com/blog/hiring-the-enemy-employment-frau...

https://www.paulgraham.com/submarine.html

le-mark•4h ago
But when the FBI tells you, you might really have a problem, as happened at one company I was at several years ago.
xkcd-sucks•2h ago
Meh, wake me up when the FBI tells me we're infiltrated by Israelis
NitpickLawyer•4h ago
> but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence.

Uhh... I have news for you: https://www.fbi.gov/wanted/cyber/dprk-it-workers

hodgesrm•3h ago
Not sure why this is downvoted. There’s now abundant evidence it’s happening.
ChrisMarshallNY•2h ago
I have a feeling there may be a Nork "flash mob" going on, like when someone says bad stuff about Musk.
spydum•3h ago
Yeah I get your skepticism, but this is really a huge issue in many industries. We are seeing it with an alarmingly high rate. You don't need a technical solution though, as the article points out, some stuff is just process change: In person final interview, gov issued ID checks, initial hardware delivery in office, etc.
bri3d•1h ago
I’ve also seen this pattern at a pervasive rate but I think it’s mostly shady overemployment / outsourcing agencies, with NK as a tag along. It doesn’t matter either way since the countermeasures are the same (besides the stupid meme KJU junk).
tropicalfruit•4h ago
company finally swipes right only to get catfished by a DPRK agent

nice

CyberMacGyver•4h ago
I am building a free service to counter exactly this problem.

This has been going on since 2018 at least and I have flagged thousands of such applicants.

tomrod•3h ago
Speak some more on this.
grej•3h ago
Yes please, I'm also interested in hearing more about what you're building CyberMacGyver
triceratops•3h ago
I'm curious why free?
hnthrow90348765•4h ago
FWIW, it the "insult Kim Jong-Un" meme that's been going around doesn't work
kyo_gisors•3h ago
Dumb racist canard is just that, who could've guessed?
rcstank•36m ago
How is it racist?
jawiggins•1h ago
Did you try it? What did the person say?
Maxious•3h ago
Jeff Geerling recently discussed being contacted by the FBI to learn more about minature KVMs, one of the devices North Korean fake IT workers use to appear to be coming from other countries https://www.youtube.com/watch?v=Lc2hB2AwHso
geerlingguy•2h ago
In this case, the KVMs are plugged into multiple laptops being run in people's basement/spare bedroom, it seems. Someone will earn a set amount per laptop per month, to accept a company-supplied laptop (from a us company) then plug in one of these little KVMs to give a remote worker access without as much ease in detection.
giantg2•3h ago
The part that's really sad is that we have tons of out of work devs right now. This sort of thing only makes it harder for the legitimate people to get hired. An easy fix for this is for a place like Pearson to set up verified interview centers, which will allow for verified virtual interviews (on both sides of the table).
ChrisMarshallNY•2h ago
Not sure why that comment got downvoted. It doesn't seem to detract from the topic at hand.

Not sure if it's feasible, but it's definitely something to consider.

lend000•1h ago
Interesting idea! This seems like a natural extension of the coworking space business concept.
giantg2•1h ago
Yeah, I was thinking of the Pearson testing centers because they're already prpctored to prevent cheating and setup for identity verification. But co-working spacings could certainly work too. That might be even more viable in Europe.
mjevans•1h ago
Another solution might be UNIONS that would have __membership verification__ including things like citizenship (which country(ies) are they a citizen of?), skills tests and training, etc.

Just like competition requires 5+ similarly sized entities for a healthy marketplace of companies, my informal opinion is that unions probably similarly shouldn't have overwhelming market share. However my feeling on contracts between unions and corporations is that the contract should be negotiated between multiple companies and multiple unions to produce the most level playing field possible.

jacob_a_dev•1h ago
At least in the US,

I like that software engineering doesnt require/encourage unions, contrary to other big industries.

As unions mature they protect the employment of their members, not prospective members who are unemployed applying for jobs.

One great thing about being a dev in the US, u dont need a degree, learn a lot, can apply and get a great job.

Ive previpusly been in a union for a company and the experience did not encourage a competitive working environment. When layoffs came, Jr employees get sacked before more senior union members (not neccesarily the best technical staff just becuase they worked there long time).

I have family/friends in unions (non software devs) that have had similar experiences to mine.

Henchman21•37m ago
You trot out all the familiar retorts. None of this is a reason to not organize to better represent the interests of labor.
giantg2•34m ago
"One great thing about being a dev in the US, u dont need a degree, learn a lot, can apply and get a great job."

And on the other side, you can have a degree and experience and still not get a job due to the wild criteria and games that get played in various interviews.

MangoToupe•10m ago
I've been working in the tech industry for about twenty years now, and I desperately want unions. Sticking your neck out alone sucks to begin with and only sucks harder the more time goes forward.
A4ET8a8uTh0_v2•1h ago
The interview process in US is already insanely ridiculous, but this would only add an additional level of crazy to it. Honestly, licensing would be less bad by comparison.
MangoToupe•11m ago
I don't really see north korean workers as any less deserving of work
Barrin92•3h ago
I don't really understand the logistics of this to be honest. From the article it doesn't sound like these people have false IDs, they just make fake LinkedIn profiles?

In a lot of countries certainly here in Germany your employer has to pay social security contributions and needs your insurance, healthcare information etc. In addition if you're a foreigner you need to know their legal status to see if they can even work. Like what do these scammed companies do, just wire money to some guy they interviewed on social media and ship company property to random addresses? Is that even legal in most places?

trinix912•3h ago
They presumably wire the money to a person operating in the US who sends a portion of that money to the NK employee. The US person is then the one in the company payroll files. At least that's my understanding.
ChrisMarshallNY•1h ago
We should definitely go after those folks, but it's not pleasant, as many of them may be having their own issues that add to the problem.

One of the big problems with the US, is that we worship money like a god. People will do almost anything, and compromise all their personal values, for money. We have entire industries that sell narratives, rationalizing these compromises.

This is exacerbated by the current employment problems. They keep talking about how unemployment is down, but I think we all know folks that are un (or under-) employed, and the difficulties they are having, finding work.

Someone in that state, is fertile ground for money- and job-laundering bad actors. It sucks to punish them, but that is what we need to do, to discourage the practice.

sylens•3h ago
That’s part of what is being exposed here. The hiring process for many companies is not very robust. I doubt many even check references
toast0•2h ago
My understanding is for a US employee, the employer is supposed to confirm eligibility to work in the first 3 days of employment. Some form of government id plus a social security card or a passport or something like that. IRS form I-9

Otoh, if these positions are independent contractors, form I-9 isn't required. Just a tax id for reporting purposes.

I would imagine whoever is hosting the laptops may be authorized to work in the US and could also be convinced to provide identity documentation. I think there's a lot of borrowing of documentation by immigrants/migrants who are not authorized to work in the US; so there's probably a marketplace somewhere too.

nobodyandproud•3h ago
Maybe this, with mandatory senior executive and board accountability, will be the wakeup call to stop the outsourcing problem of the last 50 years.
deadbabe•3h ago
What problem
rwmj•2h ago
What does this have to do with outsourcing?
nobodyandproud•10m ago
It’s about incentives.

Direct impact: Outsourcing breeds a culture of unverified and verified-just-once remote work.

Indirect impact: Outsourcing is a cost-driven effort where after a certain level of competence, the bottom-line is the only measurable metric that matters so it’s a race to the bottom with patchwork efforts to “fix” issues like OP.

Making domestic options cost-equivalent with punitive outcomes for hiring NK workers.

alganet•3h ago
I think the paranoia and fear this kind of idea promotes is perhaps the point of all of it.

Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention.

Also, we need steps towards reducing the possible tools that fake workers could leverage. These steps would put a strain on some recent technological developments. A strange and wild paradox.

markerz•2h ago
Why try to hide it? It’s like public disclosures of security vulnerabilities. You directly contact the few people who have actionable data and means to address the problem, then you tell the world that they’re impacted and should be aware that such a problem exists so we don’t repeat it.
alganet•2h ago
Private disclosures for more sensitive vulnerabilities are a recommended practice. In your analogy, that's why I aluded to.

In such cases, you only share the sensitive vulnerability publicly once there is a fix. For this case, there seems to be no fix.

One could think of it as a way to promote more scrutinized hiring processes, but it actually encourages widespread paranoia and fear.

It seems your analogy is valid, but the conclusion is that it supports what I said.

brookst•2h ago
I’m not sure it’s good for anyone to keep SMB’s in the dark, as they have the most surface area and least expertise and budget to respond. It seems like a net benefit to publicize the issue and get every IT hiring manager thinking about it.
alganet•1h ago
Can you elaborate more? It seems that you disagree but I'm missing the rationale behind it.
brookst•1h ago
Keeping it quiet and only disclosing to larger firms means that lots of small firms will hire these people, with the economic and IP harms they entails.
alganet•1h ago
As you said, small businessess have less expertise and budget to deal with the problem.

Telling your gramma she has a virus only makes her become afraid, she won't magically gain the ability to identify it. That's my whole reasoning here. It makes things worse.

nucleardog•1h ago
Inform what companies directly? If it's this pervasive, that's not going to be effective.

I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this.

And in the process of confirming that this was fishy, I contacted one of the past employers he claimed after doing my best to confirm _they_ weren't in any way part of the scam. They confirmed he had never worked there. I sent them his LinkedIn and portfolio site in case they wanted to chase down getting their name removed.

They told me that this was super concerning because the screenshots in his portfolio of the app he worked on for them were real screenshots... for an unreleased app that was only available internally and had never even been demoed for clients.

They'd already been breached and had god knows what exfiltrated. They found out because we caught an attempt to get hired at _our_ company and let them know.

Nobody outside of a couple of technical staff at our company had even _heard_ of this. Nobody at the other company had. The fix, to me, seems to be making people involved in hiring more aware of this. If anything, it seems we should be talking about this _more_ and _more publicly_.

alganet•1h ago
Is your company involved in infrastructural or emerging tech in any way?

Forgive my frankness, but these worries about infiltrators have priority in important, large companies. I am very sure agencies responsible for this can contact these handful of important companies directly.

So, you're right. In the current age we live in, no one cares about your small SaaS company, and you're being used to spread unecessary paranoia and fear.

jjmarr•1h ago
North Korea has a shortage of foreign currency.

It's not just espionage. They need US dollars to pay for smugglers.

alganet•1h ago
Greed meets greed. Companies hiring cheap labor, being exploited in several fronts.

It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in.

Keep focused. Small companies never mattered for nations, they are irrelevant. Spreading paranoia will not solve their over-reliance on this exploited offshore problem. It will likely lead them to bankrupcy.

Ultimately, it doesn't invalidate what I said. It actually makes my comment more relevant.

NitpickLawyer•1h ago
> Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention.

One key component for this scheme to work is to have local US persons act as intermediaries. While some may already know something shady is going on, and be complicit, some might not understand the entire scope of what they're being part of. Publicly discussing it might encourage some people to come forward / avoid being involved in the future.

pxc•2h ago
It's been over 75 years. It could not be clearer that this attempt to punish the ordinary people who live in North Korea for having a government that the US finds disagreeable will not succeed in somehow fomenting revolution. What it has succeeded in doing, apparently, is sustaining a level of poverty and isolation that motivates even crazy schemes like this.

Here's how to actually stop it: stop weaponizing poverty to beat a Cold War-era dead horse, and end the damn sanctions.

dontTREATonme•2h ago
Ah yes, bec that’s worked out so well with china.

Anyone with internet access in NK is working at the behest of the government.

trallnag•2h ago
Russia was an important trading partner for many European countries. Especially important for Germany. Basically no sanctions. Freedom of movement with fairly good visa policies. No great internet firewall. How much did all this help to prevent another huge war between two European countries?
shermantanktop•1h ago
Exactly. Trade ties only go so far.

But this pov isn’t always rooted in pragmatism. Free market ideologues also think that free markets will bring world peace.

pxc•1h ago
Different behaviors have different motivations, contexts, and causes. It's extremely clear that these, like other criminal moneymaking schemes in the DPRK, are directly and closely related to the high degree of isolation of the DPRK and the difficulty of getting capital into it.

Of course lifting the sanctions won't also end all spycraft, or ensure an end to geopolitical conflict. Those aren't things I have claimed or would claim.

And the primary reason to end such sanctions is not any benefit to imperialist nations but because of the fact that they inflict misery on ordinary people indefinitely and (not essential, but adding insult to injury) uselessly.

ta1243•2h ago
Have your new hire turn up and meet with the team on day one.

They'll soon twig if that's not the person who's getting called into a quick meeting in 5 minutes to discuss some new issue.

conradev•2h ago
I can’t find the tweet but apparently you can also filter these folks out by asking them to criticize Kim Jong Un
ghssds•2h ago
If someone asked me to criticize KJU, that would be the end of the conversation. I criticize people on my own or not at all. I suppose I would become a false positive.
pmarreck•2h ago
Sounds just like something a North Korean would say
brookst•2h ago
Even with the context of knowing the fake worker problem?

If so, I suppose that’s another good reason to ask the question. It filters out both North Korean fakes and people who are going to be doctrinaire about small things.

kome•1h ago
perhaps a better solution would be to ask an opinion about KJU... not to "criticize" him this feels pretty dystopic indeed, like 15m of hate...
austin-cheney•1h ago
So, again, the answering to this and most every other hiring ill in software over the past 15-20 years is… licensing.

So, let’s think about this logically. There is no baseline of candidate identification or competence in software and the jobs pay very well in physically comfortable conditions. It makes sense that unqualified liars would apply for these positions. Why shouldn’t they? I am honestly curious how far the fraud and incompetence can go and devalue the industry before someone cares enough to tackle the problem l.

hollerith•57m ago
Irrelevant to the OP unless you explain why North Koreans would be prevented from obtaining these licenses: it's not like there aren't competent developers in North Korea.

If your explanation is that the license grantor will verify that the applicant is a resident of a Western country, than the employer can just do the same verification of job applicants, dispensing with the need for the occupational license.

TypeScript 5.9 Beta

https://devblogs.microsoft.com/typescript/announcing-typescript-5-9-beta/
1•wslh•1m ago•0 comments

Selective Separation of SiO2 and SnO2 Particles in the Submicron Range

https://www.mdpi.com/2674-0516/4/3/19
1•PaulHoule•1m ago•0 comments

He went missing on Vancouver Island. A whistle and a sledge got him home

https://www.cbc.ca/news/canada/british-columbia/missing-hiker-della-falls-dallin-beaumier-1.7583066
1•colinprince•3m ago•0 comments

Hiding in plain sight – Mount namespaces

https://haxrob.net/hiding-in-plain-sight-mount-namespaces/
1•haxrob•3m ago•0 comments

The Measurement of the Microblogosphere (2025 Update)

https://stylestitches.substack.com/p/the-measurement-of-the-microblogosphere-2e4
1•thefiene•4m ago•0 comments

How Much Copper Is in the Average New Car? More Than You Think

https://www.jalopnik.com/1909782/how-much-copper-is-in-a-new-car-answer/
1•rntn•6m ago•0 comments

Apple Trace Cache

https://www.realworldtech.com/forum/?threadid=223220
1•Bogdanp•8m ago•0 comments

Most people who buy games on Steam never play them

https://howtomarketagame.com/2025/06/03/most-people-who-buy-your-game-wont-play-it/
1•3Samourai•11m ago•0 comments

Westbrook police say they mistakenly posted AI-generated drug seizure photo

https://www.pressherald.com/2025/07/01/westbrook-police-say-they-mistakenly-posted-ai-generated-drug-seizure-photo-on-facebook/
1•gnabgib•12m ago•0 comments

SMM callout vulnerabilities identified in Gigabyte UEFI firmware

https://kb.cert.org/vuls/id/746790
1•campuscodi•12m ago•0 comments

Markdown for the AI Era

https://github.com/agentmark-ai/agentmark
1•rrandall•14m ago•0 comments

Bitcoin Lottery ~$1T prize pool

https://happystoic.github.io/bitcoin-lottery/
1•rozumbrada•15m ago•0 comments

Gofumpt: A Stricter Gofmt

https://github.com/mvdan/gofumpt
1•fanf2•16m ago•0 comments

Kimi-cc: Use Kimi latest model(kimi-k2-0711-preview) to drive your Claude Code

https://github.com/LLM-Red-Team/kimi-cc
1•simonpure•17m ago•1 comments

Shoreman: Foreman in Shell

https://github.com/chrismytton/shoreman
1•tosh•20m ago•0 comments

A modular, LLM-agnostic fullstack agent framework

https://github.com/TianhongDai/modular-agent-fullstack
1•delduca•22m ago•0 comments

How Trump's crackdown on universities is affecting the world

https://www.nytimes.com/interactive/2025/07/13/us/2025-06-06-int-science-reaction-index.html
2•breadwinner•23m ago•0 comments

Latent Reflection (2025)

https://rootkid.me/works/latent-reflection
2•Bluestein•24m ago•0 comments

BB(6) Is Hard (Antihydra)

https://www.sligocki.com//2024/07/06/bb-6-2-is-hard.html
2•Fibra•28m ago•0 comments

Augustus Jansson's Queen City Ink Adverts

https://publicdomainreview.org/collection/augustus-janssons-queen-city-ink-adverts-1903-1907/
1•geox•30m ago•0 comments

Windsurf Gambit: OpenAI Acquisition Turns into Google 'Hackqusition'

https://spyglass.org/openai-windsurf-google/
1•schwentkerr•30m ago•0 comments

Show HN: CNDY – AI-First IRL Dating

https://www.cndy.world/
1•vednig•32m ago•0 comments

Unidentified object might have just crashed into Saturn

https://bgr.com/science/an-unidentified-object-might-have-just-crashed-into-saturn/
4•Bluestein•35m ago•0 comments

Infinite Torment Nexus

https://tormentnexus.live/
2•maltee•35m ago•1 comments

Haiku Activity and Contract Report, June 2025

https://www.haiku-os.org/blog/waddlesplash/2025-07-12-haiku_activity_contract_report_june_2025
1•todsacerdoti•36m ago•0 comments

Google Gemini flaw hijacks email summaries for phishing

https://www.bleepingcomputer.com/news/security/google-gemini-flaw-hijacks-email-summaries-for-phishing/
1•sandwichsphinx•38m ago•0 comments

Open-source STM32 autopilot for long-range fixed-wing UAVs (SmartNavX)

4•Talalalsohimiy•38m ago•0 comments

Datadog Acquisitions

https://www.datadoghq.com/blog/search/
1•Olshansky•39m ago•0 comments

Does Showing Seconds in the System Tray Use More Power?

https://www.lttlabs.com/blog/2025/07/11/does-showing-seconds-in-the-system-tray-actually-use-more-power
17•LorenDB•40m ago•4 comments

The Reggae Museum Foundation: Where Reggae and Dancehall History Lives

https://www.thereggaemuseumfoundation.org/about/introducing-the-reggae-museum-foundation-where-reggae-and-dancehall-history-lives/
1•gnabgib•40m ago•0 comments