On 18 September 2026, seven security agencies from Japan, the United States, Australia and Germany, among them the FBI and Germany's BND and BfV, published a joint advisory. Among other things, it describes how North Korean IT workers obtain remote jobs through other people's identities and operate the company computers from so-called laptop farms (joint advisory, NPA Japan). Its recommendations for employers centre on recruitment and on revoking access. On device enrolment, device certificates or shipping company laptops, the document is silent.
Our reading is that remote onboarding has a second checkpoint that IT controls directly: the company laptop. Who receives it, where it goes and when it gets access all belong to the identity check.
The advisory names its authors: the National Police Agency of Japan (NPA), the National Cybersecurity Office of Japan (NCO), the US Federal Bureau of Investigation (FBI), the US Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), the German Federal Intelligence Service (BND) and the German Federal Office for the Protection of the Constitution (BfV). In its German-language summary, the BfV puts the part that concerns employers plainly: the actors keep trying to get hired as remote developers, using the identities of intermediaries in Europe and elsewhere.
For recruitment, the advisory recommends, among other things:
For people already at work, the advisory tells companies, among other things, to limit information and "access rights to the minimum necessary", and, if a contractor turns out to be suspect, to "promptly revoke accounts and sessions". It also shows that the risk goes beyond salaries. In one case an IT worker extorted a company and published its source code; in another, a worker hired for website maintenance defaced the employer's site.
The advisory defines a laptop farm as "a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers". According to the agencies, the workers themselves are usually in North Korea, China or Russia. Enablers supply ID images and bank accounts, and virtual private servers hide where the work actually happens. Japanese authorities report that they identified and dismantled a laptop farm run by an enabler in Japan for the first time.
For IT, this means the company laptop sits wherever it was delivered. If it connects every morning from a residential line, that proves someone switched it on there, and nothing more.
What follows is our reading, not a recommendation from the agencies. In the scheme described, the person you hire and the person doing the work are not the same. If identity checking ends with the video interview, a laptop then goes to the address on the contract, and from that point it signs in every day without anyone asking who is sitting in front of it.
The handover is where person, place and device meet. HR and the hiring manager own the interview and the payment details. IT owns where the device goes, when it is managed and when it gets access. When both checks draw on the same data, a one-off check becomes a second chance to spot a mismatch.
We recommend four steps for any hire you will not meet in person before their first day:
Accounts and sessions are revoked promptly, as the advisory says. If you suspect a North Korean IT worker, the agencies advise contacting the police immediately. In our view, the device belongs in the same step: lock it, arrange its return and record which address it was shipped to. Whether and when to wipe it is a decision to take with a possible investigation in mind, because a wiped device no longer shows what ran on it.
The interview and the checks on ID documents and payment details stay with your HR team. We take over from device handover. With ISEC7 Endpoint Lifecycle Management, we handle devices from an employee's onboarding to their offboarding. Our Service Desk team prepares them before shipping, with function checks, OS updates and inclusion in UEM management through to inventory. With ISEC7 DEVICE AS A SERVICE, we deliver devices to the right place, office or home office, and take care of the return of hardware when someone leaves. What that means for iPhone, iPad and Mac is set out on Apple for business, and for Android fleets on Android Enterprise, ChromeOS and Google Workspace.
In ISEC7 SPHERE, the administrative steps for onboarding and offboarding come together, from hardware ordering and approval workflow to asset management. In our webcast of 18 November 2025 (in German), René Graute named onboarding and offboarding as a typical case for automation and demonstrated the user view: it brings together a person's assigned devices and services and the history of transactions on that person and their devices from all connected systems. If a suspicion is confirmed, that is where you see which devices and services belong to that person.
For the identity side of onboarding, our earlier post on digital ID verification covers the methods. Administrators can practise the set-up itself in our trainings on Apple, Android Enterprise and Samsung Knox. The recordings of the webcasts mentioned here are free after registration; all sessions are listed on our webcasts page.
The joint advisory of 18 September 2026 defines a laptop farm as a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers. According to the agencies, the workers themselves are usually located in North Korea, China or Russia, while virtual private servers hide where the work actually happens.
The advisory recommends checking that IP addresses generally match the applicant's claimed residence, verifying contact details by calling the phone number, asking for detailed explanations of the skills on the CV and checking certifications against their registration numbers. Once someone is working for you, it advises limiting access rights to the minimum necessary and promptly revoking accounts and sessions if suspicion arises.
No. It covers recruitment, payment routes, access rights and revoking access. It contains no recommendation on device enrolment, device certificates or shipping company hardware. The link between identity checks and device handover in this article is ISEC7's own reasoning, and the four shipping steps are our recommendation.
The agencies advise revoking accounts and sessions promptly and contacting the police immediately if you suspect a North Korean IT worker. In our view, the device belongs in the same step: lock it, arrange its return and record which address it was shipped to. Whether and when to wipe it is a decision to take with a possible investigation in mind.