# How to Detect and Remediate DPRK IT Workers

DevFeed: [How to Detect and Remediate DPRK IT Workers](<https://devfeed.tech/articles/you-accidentally-hired-a-dprk-it-worker-what-next-29556.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/accidentally-hired-dprk-it-worker/>)

Author: info@goteleport.com (Ben Arent)

Published: 2023-10-26T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>)

Tags: [account](<https://devfeed.tech/tags/account.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [identity](<https://devfeed.tech/tags/identity.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This guide describes warning signs and detection methods for DPRK IT workers, including inconsistent video participation, questionable coding-test behavior, logins from multiple countries, communication gaps, and mismatches between laptop locations and employee addresses. It also introduces Teleport Access Monitoring as a way to investigate suspicious access patterns.

## Source excerpt

A guide to detecting and remediating DPRK IT Workers leveraging Teleports latest Identity Governance & Security features.