North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession. The ongoing insider threat is part of what has been described as the IT worker scheme,

The article reports that DPRK-linked threat actors are expanding fraudulent overseas work schemes beyond IT into roles such as sales, marketing, and medical professions, creating an insider threat in organizations that unknowingly hire them. These facts indicate a broader pattern of state-linked workforce infiltration that can sit close to sensitive systems, data, and potential AI-enabled workflows. From a RealGround perspective, organizations using AI or AI agents in healthcare, sales, or other business functions should treat unvetted remote workers as a security control gap, as they may misuse access to AI tools for fraud, data exfiltration, or operational disruption. A structured AI Security Readiness Assessment can help identify where such insiders could interface with AI systems, tighten access controls, and implement monitoring and governance to reduce the impact of compromised or covertly state-linked staff.