What began as a scheme to generate cash for North Korea by deploying fake IT workers at American companies has now turned into an opportunity to collect intelligence from high-value targets, cybersecurity researchers warn.
New details are emerging of the sprawling spy operation within U.S. borders, with cybersecurity tech company CrowdStrike claiming it is finding one or two suspected North Korea IT worker cases every day.
The scheme is creating a heightened espionage foothold inside American companies spanning multiple industries. And CrowdStrike claims it has seen remote IT workers hand off access to malware teams when North Korea identifies intelligence worth collecting. And federal cases show overseas workers gaining access to sensitive U.S. military technology.
“They don’t discriminate,” Adam Meyers, CrowdStrike’s head of counter adversary operations, told Fox News Digital, explaining that the workers apply broadly across industries, from consumer companies to defense contractors.
CHINA-LINKED HACKERS INFILTRATED US GOVERNMENT NETWORKS BEFORE FBI TAKEDOWN
But when they land inside a “particularly juicy target,” Meyers said, CrowdStrike has seen the operation handed off to a malware team “because they realize that there’s some intelligence value and something that they want to collect.”
Meyers did not say whether the malware teams successfully collected sensitive information after those handoffs.
The FBI is now warning that the scheme poses a “significant national security and intellectual property theft insider threat.”
North Korean workers are targeting cleared defense contractors, jobs that require U.S. government security clearances, and even active-duty military personnel who can host company laptops.
Recent federal cases illustrate the stakes, from a worker who successfully accessed controlled technical information at an AI defense contractor to impostors who secured offers for jobs involving military AI and Top Secret intelligence.
In one case involving a network of U.S.-based “laptop farms” that helped overseas workers obtain remote jobs at more than 100 American companies, prosecutors identified a California defense contractor developing AI-powered equipment and technologies.
An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment.
Instead of going to the purported employee, the company laptop was shipped to a conspirator in New Jersey and ultimately transferred to a laptop farm, where software allowed the overseas worker to operate it remotely.
For more than two months, prosecutors said, the worker accessed the contractor’s systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR. The indictment said documents obtained from victim companies included information related to “sensitive U.S. military technology.”
The same contractor hired two other overseas workers using stolen American identities within roughly six weeks, prosecutors said. Their laptops were also routed through U.S.-based facilitators for remote access.
A separate case unsealed last week shows operatives pursuing positions with even more explicit national security ties.
Overseas conspirators were allowed to use the identity of a Virginia man who worked for a cleared defense contractor and held an active top secret security clearance.
One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military. The company shipped a laptop to the Virginia man’s home before discovering during a video call that the purported employee did not match the person whose identity he was using.
HOW A FOREIGN GOVERNMENT HELPED ACCUSED SAUDI SPY’S FAMILY FLEE US AFTER OPENAI BUG SCANDAL
Another impostor using the same identity was offered a $170,000 senior software engineering position requiring top secret/sensitive compartmented information clearance.
That company caught the scheme before work began after a background investigation uncovered discrepancies and a video call revealed someone who appeared roughly 30 years younger than the man whose identity he was using.
Neither impostor ultimately performed the sensitive work. But the cases show how far the operation has reached into companies handling military technology and positions requiring some of the government’s highest security clearances.
CrowdStrike began tracking the North Korean IT worker campaign it calls Famous Chollima in March 2024 after investigating what initially appeared to be a single malicious insider. Investigators soon identified dozens of other victims among its customers.
Unlike traditional espionage operations targeting specific organizations, Meyers said, the workers cast a wide net, applying for hundreds or thousands of remote IT jobs.
The primary objective is generating revenue for North Korea, according to CrowdStrike, which has linked Famous Chollima to the country’s Munitions Industry Department. Meyers said the money helps fund North Korea’s weapons program.
But access to a valuable target can create an additional intelligence opportunity.
Treasury last week sanctioned another North Korean IT-worker network, saying the regime takes most of the workers’ wages and generates hundreds of millions of dollars to fund its weapons of mass destruction and ballistic missile programs.
Treasury also warned that workers have exploited corporate access to deploy malware, steal proprietary information and remove sensitive data.
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said.
The operation relies on stolen identities, increasingly sophisticated deception and U.S.-based facilitators who provide the physical footprint overseas workers lack.
After a worker is hired, a company laptop can be shipped to a facilitator’s home and configured for remote operation, making it appear to company systems that the employee is working inside the United States.
Artificial intelligence is also making the deception more sophisticated.
Meyers said operatives use AI to create convincing LinkedIn profiles and resumes, answer interview questions and increasingly alter their appearance on video calls. Some also use AI to help perform the jobs after being hired.
The FBI says workers have purchased access to identity-verification services to test stolen identities, hired Americans to appear on camera or complete employment requirements and sometimes subcontracted entire jobs to other foreign workers.
The bureau also warned that workers “almost always” remove data from victim companies because many are required to record their screens to document daily work.
Federal authorities have intensified efforts to dismantle the infrastructure supporting the operation.
In October, the FBI searched more than 40 suspected laptop farms across Texas, seizing 187 laptops and other devices. The DOJ said coordinated actions announced that day affected more than 70 U.S. companies.
“This investigation is about far more than fraud,” U.S. Attorney Ryan Raybould said. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.”
Meyers said CrowdStrike has identified laptop farms through patterns across multiple cases and passed information to the FBI, contributing to searches and arrests of U.S.-based facilitators.
North Korea has also exploited the other side of the hiring process, with operatives posing as recruiters to target employees already inside companies.
In a separate cryptocurrency theft investigation, Binance said a software engineer had been approached through a legitimate job platform by someone posing as an executive at a fictitious company, part of what it suspected was a North Korean effort to compromise employees through fake interviews.
Meyers said companies must treat identity verification as a security issue, not simply a hiring function, and train recruiters and security teams to recognize the tactics.
“They’re an employee, so they have access to whatever an employee would have,” Meyers said of workers who successfully get through the hiring process.
“And that could be … the crown jewels.”