North Korea's Fake IT Worker Scheme Takes a Dangerous Turn as New Threats Emerge

What began as a scheme to generate cash for North Korea by deploying fake IT workers at American companies has now turned into an opportunity to collect intelligence from high-value targets, cybersecurity researchers warn.

New details are emerging of the sprawling spy operation within US borders, with cybersecurity tech company CrowdStrike claiming it is finding one or two suspected North Korea IT worker cases every day.

The scheme is creating a heightened espionage foothold inside American companies spanning multiple industries. CrowdStrike claims it has seen remote IT workers hand off access to malware teams when North Korea identifies intelligence worth collecting, and federal cases show overseas workers gaining access to sensitive US military technology.

"They don't discriminate," Adam Meyers, CrowdStrike's head of counter adversary operations, said, explaining that the workers apply broadly across industries, from consumer companies to defence contractors. But when they land inside a "particularly juicy target", Meyers said, CrowdStrike has seen the operation handed off to a malware team "because they realise that there's some intelligence value and something that they want to collect". Meyers did not say whether the malware teams successfully collected sensitive information after those handoffs.

The FBI is now warning that the scheme poses a "significant national security and intellectual property theft insider threat".

North Korean workers are targeting cleared defence contractors, jobs that require US government security clearances, and even active-duty military personnel who can host company laptops.

In one case involving a network of US-based "laptop farms" that helped overseas workers obtain remote jobs at more than 100 American companies, prosecutors identified a California defence contractor developing AI-powered equipment and technologies. An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment. Instead of going to the purported employee, the company laptop was shipped to a conspirator in New Jersey and ultimately transferred to a laptop farm, where software allowed the overseas worker to operate it remotely. For more than two months, prosecutors said, the worker accessed the contractor's systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR; documents obtained included information related to "sensitive US military technology". The same contractor hired two other overseas workers using stolen American identities within roughly six weeks, prosecutors said.

A separate case unsealed last week shows operatives pursuing positions with even more explicit national security ties. Overseas conspirators were allowed to use the identity of a Virginia man who worked for a cleared defence contractor and held an active top secret security clearance. One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the US military; the company shipped a laptop to the Virginia man's home before discovering during a video call that the purported employee did not match the person whose identity he was using. Another impostor using the same identity was offered a $170,000 senior software engineering position requiring top secret/sensitive compartmented information clearance; that company caught the scheme before work began after a background investigation uncovered discrepancies and a video call revealed someone who appeared roughly 30 years younger than the man whose identity he was using. Neither impostor ultimately performed the sensitive work.

CrowdStrike began tracking the North Korean IT worker campaign it calls Famous Chollima in March 2024 after investigating what initially appeared to be a single malicious insider; investigators soon identified dozens of other victims among its customers. Unlike traditional espionage operations targeting specific organisations, Meyers said, the workers cast a wide net, applying for hundreds or thousands of remote IT jobs.

The primary objective is generating revenue for North Korea, according to CrowdStrike, which has linked Famous Chollima to the country's Munitions Industry Department. Meyers said the money helps fund North Korea's weapons programme. But access to a valuable target can create an additional intelligence opportunity.

The Treasury last week sanctioned another North Korean IT-worker network, saying the regime takes most of the workers' wages and generates hundreds of millions of dollars to fund its weapons of mass destruction and ballistic missile programmes. Treasury also warned that workers have exploited corporate access to deploy malware, steal proprietary information and remove sensitive data. "The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives who weaponise sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said.

The operation relies on stolen identities, increasingly sophisticated deception and US-based facilitators who provide the physical footprint overseas workers lack. After a worker is hired, a company laptop can be shipped to a facilitator's home and configured for remote operation, making it appear to company systems that the employee is working inside the United States. Artificial intelligence is also making the deception more sophisticated: Meyers said operatives use AI to create convincing LinkedIn profiles and resumes, answer interview questions and increasingly alter their appearance on video calls, and some also use AI to help perform the jobs after being hired. The FBI says workers have purchased access to identity-verification services to test stolen identities, hired Americans to appear on camera or complete employment requirements and sometimes subcontracted entire jobs to other foreign workers; the bureau also warned that workers "almost always" remove data from victim companies.

Federal authorities have intensified efforts to dismantle the infrastructure supporting the operation. In October, the FBI searched more than 40 suspected laptop farms across Texas, seizing 187 laptops and other devices; the Justice Department said coordinated actions announced that day affected more than 70 US companies. "This investigation is about far more than fraud," US Attorney Ryan Raybould said. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders." Meyers said CrowdStrike has identified laptop farms through patterns across multiple cases and passed information to the FBI, contributing to searches and arrests of US-based facilitators.