The FBI warns that state-controlled North Korean IT workers are expanding their use of U.S. facilitators, distributed laptop farms, stolen identities, and subcontracted labor to obtain and retain remote jobs at Western companies. The workers generate revenue for the DPRK government while stealing data and intellectual property, and the FBI has recently observed extortion, death threats, and in-person intimidation following account closures or termination. Operators also seek access to cleared defense-contracting positions and recruit active-duty military personnel to host devices. Organizations are advised to use layered, continuously refined identity controls because no single technical or behavioral indicator reliably distinguishes the scheme from legitimate remote work.