The FBI warned that North Korean IT workers have expanded beyond revenue generation into data theft and extortion against U.S. businesses. Recent cases include workers using unlawful network access to exfiltrate proprietary data and code, copy repositories to personal cloud or GitHub accounts, and demand ransom after discovery. The advisory gives defenders hiring and monitoring signals such as unusual multi-country logins, remote desktop tooling, shared contact details across applicants, AI or face-swapping use in interviews, and non-U.S. education claims.