North Korea’s Fake IT Workers Are Now Spying on American Defense Contractors

We’ve got a problem that’s metastasizing faster than anyone wants to admit. North Korea started this whole scheme as a cash grab, deploying fake IT workers to American companies to fund Kim Jong Un’s weapons programs. Smart play for a broke regime, right? Except now it’s morphed into something far more sinister. These workers aren’t just collecting paychecks anymore. They’re collecting intelligence.

CrowdStrike is finding one or two new cases every single day. Think about that for a second. Every day, another North Korean operative gets discovered embedded in an American company. And those are just the ones we’re catching.

Here’s where it gets really ugly. When these workers land inside what Adam Meyers at CrowdStrike calls a "particularly juicy target," they hand off access to malware teams. We’re talking about deliberate espionage operations targeting defense contractors, companies with security clearances, and firms handling sensitive military technology. The FBI isn’t mincing words either. They’re calling this a "significant national security and intellectual property theft insider threat."

The audacity of this operation is breathtaking. In one federal case, an overseas worker using a stolen American identity got hired as a software engineer at a California defense contractor developing AI-powered military equipment. The company shipped a laptop to a conspirator in New Jersey, who then transferred it to what prosecutors call a "laptop farm." For more than two months, this worker accessed controlled technical data, including material regulated under the International Traffic in Arms Regulations. That’s the stuff we guard because it could literally kill Americans if it falls into enemy hands.

The same contractor hired two more imposters within six weeks. Same stolen identities, same laptop routing scheme, same access to military secrets.

Another case shows just how high these operatives are reaching. They were using the identity of a Virginia man who held an active top secret security clearance. One imposter landed a $130,000 offer for a generative AI project supporting the U.S. military. Another scored a $170,000 position requiring top secret and sensitive compartmented information clearance. That’s some of the highest classification levels our government has. Fortunately, both got caught during video calls when the imposters didn’t match the real person’s appearance. One guy looked thirty years younger than the identity he’d stolen.

But here’s the thing that should keep you up at night. Those are the ones we caught. How many didn’t we?

The operation works because it’s built on volume. These aren’t precision strikes against specific targets. North Korean operatives apply for hundreds or thousands of remote IT jobs across every industry you can imagine. Consumer companies, tech firms, defense contractors. They don’t discriminate because they can’t afford to. Cast a wide enough net and eventually you’ll snag something valuable.

The primary goal remains generating revenue. Treasury sanctioned another network just last week, estimating these schemes generate hundreds of millions of dollars for North Korea’s weapons programs. The regime takes most of the wages these workers earn. It’s a brilliant funding mechanism for a country that’s been economically isolated for decades.

But when they stumble into a company handling classified information or developing military technology, the mission changes. That’s when the intelligence operatives take over and the real damage begins.

This whole mess relies on stolen American identities and a network of U.S.-based facilitators who provide the infrastructure these workers need. We’re talking about American citizens or residents who are actively helping a hostile foreign regime spy on their own country. Some are probably doing it for money. Others might not fully grasp what they’re enabling. Either way, they’re traitors.

The sophistication keeps increasing too. These aren’t crude attempts that get flagged immediately. The deception is good enough to fool hiring managers, pass initial screenings, and get company equipment shipped to safe houses across America. The whole operation has become industrialized.

Treasury Secretary Scott Bessent put it plainly last week. "The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives who weaponize sensitive data and extort businesses for substantial payments."

CrowdStrike started tracking what they call the Famous Chollima campaign in March 2024. What looked like a single malicious insider turned out to be dozens of victims just among their customer base. The campaign links back to North Korea’s Munitions Industry Department, which tells you everything you need to know about where the money and intelligence ultimately flow.

You know what’s particularly galling about this? We created the vulnerability. Remote work opened incredible opportunities for flexibility and talent acquisition. It also opened a door we’re now struggling to close. The same technology that lets a qualified engineer in Ohio work for a company in California lets a North Korean operative in Pyongyang do the same thing.

The solution isn’t abandoning remote work. But it sure as hell requires better identity verification, more rigorous screening for positions touching anything sensitive, and actual consequences for the facilitators making this possible. We need companies to treat hiring like the security decision it actually is, especially when classified information or military technology is involved.

Every day that passes without stronger safeguards is another day North Korea finds someone new to exploit. This isn’t theoretical anymore. It’s happening right now, funding weapons programs aimed at American allies and stealing secrets that undermine our national defense.

We can either take this threat seriously or keep pretending our current screening processes are adequate. One of those options leads to more stolen identities, more compromised defense contractors, and more money flowing to Pyongyang. The other requires admitting we’ve got a problem and actually fixing it.