North Korea's Fake Worker Scheme Now Reaches Into Hospitals and Sales Teams
The DPRK-linked hiring fraud that dogged tech firms is turning up in healthcare and sales roles, widening the insider risk for employers who thought they weren't a target.
Key points
- Investigators have linked suspected North Korean workers to jobs in sales, marketing and healthcare, not just software engineering.
- The scheme, known as the DPRK IT worker fraud, funnels wages back to the sanctioned regime in Pyongyang.
- Employers outside the tech sector are now in scope, including hospitals that handle sensitive patient data.
- The insider risk covers both stolen data and money leaving the company payroll for a sanctioned government.
- Hiring controls, not firewalls, are the main defence against this specific problem.
For a couple of years the standard warning went like this: if you hire remote software engineers, some of the CVs in your inbox are fake, and the person on the other end of the video call may be a North Korean operative working from China or Russia. Most companies outside tech shrugged and moved on.
That shrug is starting to look expensive.
According to The Hacker News, investigators have now traced suspected North Korean workers into sales and marketing roles, and into the medical profession. The IT worker scheme, as the US Treasury and FBI have called it, is no longer just an IT problem.
What is the "IT worker scheme"?
It's a long-running fraud in which people working for the North Korean government pose as freelance or remote employees, get hired by Western companies, and send their salaries back to Pyongyang. The regime uses that money to fund weapons programmes while operating under heavy international sanctions.
In practice, the workers use stolen identities, western-sounding names and sometimes a paid accomplice inside the United States who runs a "laptop farm" so the machine appears to be sitting in Dallas or Denver rather than Pyongyang. The hiring manager sees a normal remote hire. Payroll sees a normal direct deposit. Nobody sees the money going to a sanctioned state. We covered how that playbook actually runs in our 11 August investigation, which recorded every keystroke on laptops issued to three suspected North Korean hires.
Why are healthcare and sales roles now in the mix?
Remote hiring exploded across every industry, not just software. A hospital group hiring a remote medical coder, or a SaaS vendor hiring a remote sales development representative, uses the same LinkedIn-plus-Zoom pipeline as a tech startup. The controls are usually weaker.
A sales role is attractive for a different reason than an engineering one. Salespeople get customer lists, pricing and CRM access to thousands of contacts. Useful intelligence. A medical role can mean access to patient records, which are protected under HIPAA in the US and carry real regulatory weight if they leak.
The failure mode here isn't a clever exploit. It's a hiring process that never seriously verified who was sitting behind the webcam.
Where the risk shows up
| Sector | What the fake worker gets access to | Main risk |
|---|---|---|
| Software / IT | Source code, cloud consoles, production data | Data theft, later extortion |
| Sales & marketing | CRM, customer lists, pricing | Competitive intel, phishing lures |
| Healthcare | Patient records, billing systems | HIPAA fines, identity fraud |
| Any sector | Payroll | Sanctions violations |
Should you worry if you're not in tech?
Yes, if you hire remotely. That's the uncomfortable shift this reporting marks. Our earlier story on how Huntress investigated three successful infiltrations at Western companies showed the red flags were consistently in the interview, and consistently missed.
If you're an employee, the useful signal is a new remote colleague whose camera is always off, whose voice doesn't match their accent, or who insists on shipping their work laptop to an address that isn't theirs. Tell HR.
Your recruiters are your first line of defence here, not your SOC team.
