On 13 October 2026, the US Justice Department announced coordinated actions against North Korean remote IT worker schemes that it says affected more than 70 US companies, including employers in manufacturing. The same day, the FBI published a public service announcement warning that these fake remote workers now rely on more helpers, recruit more widely, and threaten to leak corporate data, and even harm former managers, when they are fired.
The scheme is simple to describe and hard to spot. People working for the North Korean state apply for remote jobs under stolen or borrowed identities. Once hired, they log in to company laptops that sit in the homes of paid helpers in the United States, so the connection looks local. The salaries flow back to North Korea. According to the Justice Department, the revenue funds the regime, including its weapons programmes.
For deep-tech and hardware companies, this is not only an HR fraud problem. A remote engineer, developer or CAD contractor gets accounts, repositories, PDM vaults and design files on day one. If that person is not who they claim to be, your most valuable files sit with someone you have never met, and who may use them as leverage later. Here is what was announced, what the FBI says to look for, and how to limit what a fake hire can take.
TL;DR: the North Korean IT worker crackdown in one paragraph
On 13 October 2026, the US Justice Department unsealed an Ohio indictment against two US nationals and ten China-based individuals over a scheme that allegedly placed North Korean IT workers at more than 70 US employers and generated more than $3 million between 2019 and about July 2025. In Texas, the FBI searched more than 40 suspected laptop farms and seized about 187 laptops and KVM devices. An FBI alert lists new tactics, including subcontracting work to freelancers, renting real people's professional profiles, seeking cleared defence jobs and extorting employers with stolen data. The lesson for engineering teams: verify identity across the whole employment lifecycle, watch for remote-control tools on work laptops, and protect design files at file level so a fake hire cannot walk away with them.
What did US authorities announce on 13 October 2026?
Two enforcement actions were announced together. In the Northern District of Ohio, a four-count indictment charges wire fraud, money laundering and identity theft. Two US nationals were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten China-based individuals are also charged, and two more defendants remain under seal. Prosecutors say the scheme ran from 2019 to about July 2025, brought in more than $3 million and affected more than 70 US employers in health care, communications, cyber support, retail and manufacturing, across Ohio, 16 other states and the District of Columbia.
In the Northern District of Texas, under Operation Lonestar Roundup, the FBI searched more than 40 homes known or suspected to be laptop farms between 21 and 25 September 2026 and seized about 187 laptops and keyboard-video-mouse (KVM) devices. The Justice Department's announcement also lists fraudulent email addresses tied to the schemes so that employers can check their own applicant records. The security company CrowdStrike, which tracks the group as Famous Chollima, helped with the disruption.
The US Attorney for the Northern District of Ohio, David M. Toepfer, framed it as a hiring problem: "These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices." As always, the charges are allegations, and the defendants are presumed innocent unless proven guilty.
How does a fake remote IT worker scheme work?
The model has several layers, and each one is designed to make a remote hire look normal. First, the identity: according to the FBI, most names and addresses given to employers are stolen, and the workers buy verification accounts or licences to get through background checks. Second, the face: helpers are paid to appear on camera, join interviews or lend their real social media and professional networking accounts, which carry years of history and look trustworthy.
Third, the location. The employer ships a work laptop to an address in the United States. A paid facilitator keeps it switched on and connected, and the worker controls it from abroad through remote desktop software or a KVM-over-IP device. To the company, the traffic comes from a home in Texas or Pennsylvania. Fourth, the work itself: the FBI says the workers increasingly subcontract tasks to freelancers, mainly in Pakistan, India and Nigeria, so the person doing the job may be a third party the employer never vetted at all.
This is the same pattern we described in our analysis of insider threats after the OpenAI hidden recording device case: the dangerous person is already inside, with valid credentials. The difference here is that the insider was never real to begin with.
What is new in the FBI warning?
The FBI public service announcement I-101326-PSA describes how the operation has adapted to better detection. Instead of a few big laptop farms, the workers now spread their devices across more farms with fewer laptops each, so one search does not take everything down. They recruit Americans under financial stress as facilitators, sometimes using their identities without permission.
Three points matter most for technology companies. The workers look for jobs that need a security clearance or rare skills, including at cleared defence contractors, and they approach active-duty military members to host laptops. When they are fired, some threaten to release sensitive corporate data or post proprietary information unless they are paid. And the FBI reports death threats against former managers and their families, in some cases backed by in-person intimidation through US-based helpers.
The FBI is careful on one point: no single indicator proves anything. Many legitimate engineers use remote desktop tools or move house. The signal is a combination of behaviours that each look harmless on their own.
Why should deep-tech and hardware companies care?
Manufacturing is one of the victim sectors named in the Ohio case. No engineering or CAD company was named, and the announcements do not describe theft of design files. But the access that remote technical roles get is exactly what makes them attractive. A remote mechanical engineer, firmware developer or PLM administrator typically receives VPN credentials, a CAD seat, read access to a PDM or PLM vault, and often write access to shared drives with customer drawings.
That access does not end when the contract ends unless someone removes it, and files already copied do not come back. The FBI's extortion warning is the uncomfortable part: a worker who can threaten to publish your 3D models, bills of materials or test data has leverage long after leaving. Our guide to preventing CAD file exfiltration by former employees covers the departure side of this risk in detail.
European companies are not out of reach either. In April 2025, Google's threat intelligence team reported that North Korean IT workers were expanding into Europe, with fake personas found in Germany, Portugal and the UK, as US enforcement made American jobs harder to get. Startups that hire remote contractors through freelance platforms, often without in-person meetings, are exactly the kind of employer the scheme relies on.
Which warning signs should engineering managers look for?
The FBI alert and the Justice Department announcement point to the following signals. The table maps each one to the place where engineering teams can actually check it.
None of these checks needs a big budget. Most companies already have endpoint management and payroll records. What is usually missing is the habit of putting HR, IT and engineering signals in one place, which is exactly what the FBI recommends.
How can you stop a fake hire from taking your CAD files?
Hiring checks reduce the chance that a fake worker gets in. They will never bring it to zero, because the identities are real people's identities and the faces on camera can be paid stand-ins. So the second line of defence is to assume that one day a remote account will belong to the wrong person, and to design file access so that this does not become a loss of your product.
That means giving each role only the files it needs, not the whole vault; keeping sensitive models encrypted with permissions attached to the file itself, so a downloaded copy stays locked; logging every open, so you can show what a suspect account touched; and being able to revoke access to files that have already left your systems. Our explainer on the difference between CAD file encryption and access control shows why you need both.
Contracts still matter, but they do not stop a sanctioned foreign worker who will never appear in a European or American court. As we argue in why NDAs alone are not enough to protect CAD files, technical control has to back up the paperwork. The same applies to subcontractors beyond your first-level partners, which matters even more now that the FBI says the workers pass tasks on to unvetted freelancers.
Keep control of every CAD file, even with remote teams. CADChain adds file-level access control, access logs and blockchain proof of ownership to CAD files, across CAD systems, so a file shared with the wrong account can be locked again.
👉 See how CADChain protects CAD files
What should engineering teams do now?
- Check your applicant and contractor records against the fraudulent email addresses listed in the Justice Department announcement.
- Verify identity live and more than once. Use a live video check with an ID document at hiring, and repeat verification at key moments such as access upgrades. The FBI calls this "identity in depth".
- Control the laptop. Ship work devices only to verified addresses, block unapproved remote desktop tools and alert on KVM-over-IP devices and second machines.
- Give new remote hires the minimum. Grant CAD, PDM and PLM access by project, not by department, and expand it only after a probation period.
- Protect the files themselves. Encrypt sensitive models, attach permissions to each file and keep a log of every open, so a copied file stays useless and traceable.
- Join up HR, IT and security. Review weak signals together: payroll changes, odd login locations, unusual tools, refusal to meet in person.
- Plan the exit. On termination, revoke access before the conversation, preserve logs and report threats or extortion to the police or the FBI's IC3 portal.
For a broader framework that connects these steps, see our 8-layer IP protection playbook for deep tech and hardware teams and the trade secrets guide for deep-tech startups, which explains why reasonable protection measures matter if you ever need to go to court.
How does this connect to other recent cases?
Last week brought several reminders that the biggest risk to design data often has valid credentials. Apple's case against OpenAI is about engineers who changed employers, covered in our article on what hardware teams should learn from Apple v. OpenAI. And the joint advisory on China-linked hackers for hire targeting critical manufacturing showed how stolen passwords open the same doors from outside. A fake remote hire is the third route: no exploit, no break-in, just a job offer.
How does this fit the bigger picture?
Our sister sites covered other ways in which access to design data is changing this week.
- AI agents inside CAD. Open-source MCP servers now let AI agents work directly in CAD tools. Read what SOLIDWORKS MCP servers mean for AI agents and design ownership on solidboris.com.
- Leaked PLM data. The Clop gang published data from its PLM campaign, including MRI scanner drawings it says came from Philips. Our sister site explains what the Clop PLM data leak means for Inventor and Vault teams.
- AI training and fair use. A US appeals court ruled for the first time on fair use in AI training. Blended BORIS looks at what the Thomson Reuters v. ROSS ruling means for 3D artists.
Conclusion
The 13 October actions show that the North Korean remote IT worker scheme is large, adaptable and still running. It hit more than 70 US employers in one case alone, manufacturing among them, and the FBI says the workers are now spreading out, subcontracting and turning to extortion when caught.
For engineering companies, the practical answer has two parts. Make it harder for a fake person to get hired, by verifying identity live and repeatedly and watching for remote-control tools. And make sure that if one does get in, your design files stay locked to the right people, with a record of every access. Hiring checks can fail. File-level control still works after they do.
Make sure only verified people can open your designs. CADChain gives engineering teams file-level access control, access logs and blockchain proof of ownership for CAD files, across CAD systems.
👉 See how CADChain works
FAQ: North Korean IT workers and engineering companies
What did the Justice Department announce on 13 October 2026?
Coordinated actions against North Korean remote IT worker schemes: an Ohio indictment against two US nationals and ten China-based individuals over a scheme that allegedly affected more than 70 US employers and generated more than $3 million, and FBI searches of more than 40 suspected laptop farms in Texas.
What is a laptop farm?
A home where a paid facilitator keeps company laptops switched on and connected, so that a worker abroad can control them remotely while the traffic appears to come from inside the United States.
Were engineering or manufacturing companies affected?
Manufacturing is one of the victim sectors named in the Ohio case. No specific engineering or CAD company was named, and the announcements do not describe theft of design files.
What new tactics does the FBI describe?
More facilitators and smaller laptop farms, rented professional networking accounts, subcontracting work to freelancers, seeking jobs that need security clearances, and extortion with threats to leak corporate data, including threats against former managers.
Which tools are warning signs on a work laptop?
The FBI lists remote desktop and monitoring tools such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop, KVM-over-IP devices such as TinyPilot, PiKVM and GL.iNet, and unrelated software such as OBS Studio with the VDO.Ninja plugin. No single sign proves fraud.
Are European companies at risk?
Yes. Google's threat intelligence team reported in April 2025 that North Korean IT workers were expanding into Europe, with fake personas found in Germany, Portugal and the UK.
How does file-level CAD protection help?
If sensitive models are encrypted with per-file permissions and access logs, a fake hire only sees the files their role needs, copies stay locked, access can be revoked, and every open leaves evidence.
