North Korea's fake IT workers target U.S. defense firms for cash and secrets

North Korean operatives are using fake identities to secure remote IT jobs at American companies, creating a direct pipeline for cash and espionage. Cybersecurity firm CrowdStrike reported that it detects one or two suspected cases of this scheme daily. The operation has shifted from a simple money-making tactic to a method for extracting intelligence from high-value corporate targets.

The campaign, which CrowdStrike tracks as Famous Chollima, began in earnest in March 2024. Researchers initially found a single malicious insider but quickly identified dozens of other victims. The primary goal is revenue for the Munitions Industry Department in North Korea. Treasury officials stated that the regime takes most of the workers' wages to generate hundreds of millions of dollars for weapons programs.

Federal cases reveal how the scheme reaches into sensitive sectors. In one indictment, an overseas worker using a stolen American identity was hired as a software engineer in January 2024 at a California defense contractor. The company shipped a laptop to a facilitator in New Jersey. The worker accessed systems for two months, downloading data controlled under International Traffic in Arms Regulations.

The same contractor hired two other fake employees within six weeks. In a separate case unsealed last week, operatives used the identity of a Virginia man with a top secret clearance. One impostor received a $130,000 offer for a generative AI role with a military component. Another was offered a $170,000 senior position. Both companies caught the fraud during video calls or background checks before the impostors began work.

The U.S. Department of the Treasury sanctioned another IT-worker network last week. Secretary Scott Bessent said the regime weaponizes sensitive data and extorts businesses. The FBI warned that workers almost always remove data from victim companies because many firms require screen recording for documentation.

Federal authorities have moved to dismantle the physical infrastructure supporting these remote workers. In October, the FBI searched more than 40 suspected laptop farms in Texas. Agents seized 187 laptops and other devices. The Department of Justice said these coordinated actions affected more than 70 U.S. companies. U.S. Attorney Ryan Raybould described the effort as a fight against a hostile foreign regime infiltrating American borders.

CrowdStrike head of counter adversary operations Adam Meyers said the workers apply broadly across industries. They use AI to create convincing profiles and answer interview questions. Meyers noted that when a worker lands inside a valuable target, the operation is often handed off to a malware team to collect intelligence. He advised companies to treat identity verification as a core security function rather than a routine hiring step.