You vet CVs. You check references. You run interviews. But what if the person you just hired to manage your IT systems is secretly funnelling money to a hostile foreign government?
It sounds like a spy thriller, but it is happening right now, to real businesses, across 40 countries. And if you are a UK SMB hiring remote IT contractors, you need to pay attention.
This month, researchers from IBM X-Force and Flare Research published a report that maps out, in detail, how North Korea operates an army of approximately 100,000 fake IT workers. These are not hackers trying to break into your systems from outside. They are people who apply for legitimate IT jobs, get hired, and then quietly siphon data and money back to Pyongyang.
The numbers are staggering. According to the US Government, these workers can earn over $300,000 per year each, generating roughly $500 million annually for the North Korean regime. They are spread across 40 countries, working as remote developers, system administrators, and IT support staff.
That is not a niche problem. That is an industrial-scale operation.
The operation is surprisingly well-organised, with clear roles and a structured hierarchy that mirrors a legitimate recruitment business.
Many candidates may not even realise who they are really working for. Recruiters tell them they are joining an “early-stage stealth startup” with no public information. They are given a US or UK-based identity to use, complete with fabricated credentials and work history.
The fake workers target freelancing platforms like Upwork, LinkedIn, and Freelancer. Researchers found timesheets detailing how many “bids” workers made on freelancing sites each day and how many messages they sent on professional platforms.
They use counterfeit accounts or verified profiles linked to real people. Their applications look legitimate because they are crafted using professional templates and translated through Google Translate.
Once hired in a full-time role, these workers are often highly productive. Why? Because multiple people may be collaborating behind the scenes to do the work. The goal is to perform well, earn promotions, and gradually gain more privileged access to company IT systems.
You might think this only affects large enterprises or American tech companies. It does not.
UK SMBs are increasingly turning to remote contractors for IT work. It makes sense: you get specialist skills without the overhead of a full-time hire. But this trend also makes smaller businesses a prime target.
Here is why SMBs are particularly vulnerable:
If you run a manufacturing company in the Midlands and you hire a remote developer to build an internal tool, that person could potentially access your production systems, customer data, financial records, and intellectual property.
This is not just about money being funnelled to North Korea. A fraudulent IT worker inside your business can:
The Stryker cyberattack this month, where Iran-linked attackers used Microsoft Intune to remotely wipe employee devices, shows what happens when hostile actors get inside your management tools. A fake IT worker with admin access could do the same thing.
The IBM/Flare report identifies several red flags that businesses should watch for during the hiring process.
You do not need to stop hiring remote workers. But you do need to be smarter about it. Here are practical steps every UK SMB should take.
Do not rely on a CV and a video call. Use identity verification services that check government-issued ID. For UK-based contractors, verify their right to work. For international hires, use platforms that include identity verification as part of the process.
Insist on camera-on interviews. Ask candidates to show their physical workspace. Ask spontaneous questions that require real-time thinking rather than scripted answers. Watch for signs of deepfake technology or AI voice manipulation.
Do not just call the number on the CV. Look up the company independently and call their main line. Verify that the reference person actually works there. Cross-reference LinkedIn profiles with company websites.
Give every contractor the minimum access they need to do their job, and nothing more. This limits the damage if someone turns out to be fraudulent. Review access permissions regularly and revoke anything that is no longer needed.
Use endpoint management tools to monitor what devices are connecting to your network. Log access to sensitive systems. Set up alerts for unusual activity, like data downloads outside normal hours or connections from unexpected locations.
One of the best ways to reduce risk is to work with a trusted, local IT support provider rather than hiring unknown remote contractors. A managed service provider gives you vetted professionals, proper security controls, and accountability. You know exactly who has access to your systems.
Make sure anyone involved in hiring IT staff, whether that is HR, department managers, or directors, knows about this threat. The warning signs are not obvious unless you know what to look for.
This is not just a North Korea problem. The techniques being used, fake identities, AI deepfakes, stolen credentials, will inevitably be adopted by other threat actors. Criminal groups, corporate espionage operations, and other state-sponsored programmes are all watching how this plays out.
The shift to remote work has created enormous opportunities for businesses. But it has also created new attack surfaces that did not exist five years ago. Your hiring process is now part of your cybersecurity strategy, whether you like it or not.
If you are hiring remote IT contractors, review your vetting process this week. If you are not sure whether your current setup is secure, that is exactly the kind of thing a good IT partner can help with.
At Magnetar IT, we help businesses across the Midlands build secure IT operations without the guesswork. From endpoint management and access controls to vetting and monitoring, we handle the security so you can focus on running your business.
89% of our support tickets are resolved within an hour, and we have over 10 years of experience keeping SMBs safe.
Get in touch for a free consultation and let us make sure your hiring process is not your weakest link.
Date: March 31, 2026
Author: Rafael Macedo