DPRK IT Worker Threat — Detection & Mitigation Framework

Compiled from FBI IC3 PSA, DTEX i3 community reporting, and practitioner briefings.

This framework translates a high-sensitivity threat briefing into a practical operational playbook. It is organized across four phases that teams can operationalize: Pre-Hire Screening, Interview, Onboarding, and Post-Hire Monitoring.

Source Key

• FBI IC3 PSA: Official U.S. government guidance on DPRK IT worker threats to U.S. businesses.
• Barnhart (AMA): Practitioner commentary from Michael Barnhart, DTEX i3 Senior Investigator.
• DTEX i3 Advisory / Community: Additional field observations from current investigations and practitioner reporting.

Phase 1: Pre-Hire Screening

Pre-hire screening is the highest-leverage intervention point. Broad coverage is possible, but sustained scrutiny is what exposes synthetic identities and coordinated facilitator networks.

Phase 2: Interview

The interview layer now includes deepfake and real-time AI evasion. Controls should require visible identity continuity and operational friction that is hard to automate around.

Phase 3: Onboarding

Onboarding is a transition point where operational control can be transferred away from a real individual. Harden identity and access boundaries before granting durable privileges.

Phase 4: Post-Hire Monitoring

Post-hire monitoring catches operators that pass early stages. Most reliable indicators are activity and identity continuity signals visible from endpoint and identity telemetry.

Organizational & Program Controls

Technical controls only work when people processes are aligned.

• Cross-Functional Briefing: Align insider risk, threat intel, HR, legal, and security with a shared threat model.
• HR-Specific Threat Briefings: Equip recruiters with real examples so suspicious patterns are escalated faster.
• Medical Leave / HR Process Awareness: Train HR and legal on how leave protections can be exploited in near-detection exit delays.
• FBI Field Office Relationship: Maintain reporting channels with local FBI Private Sector Coordinators for threat sharing and response.
• ISAC / Peer Network Collaboration: Share sanitized indicators with peer organizations for enrichment and matching.

Legal & Compliance

If payments were made to suspicious operators or facilitators, consider voluntary disclosure with OFAC and coordinate closely with legal counsel before any termination action. This is critical because documented cases have shown process abuse and prolonged disruption attempts through policy protections.