What began as a scheme to generate cash for North Korea by deploying fake IT workers in American companies has now turned into an opportunity to collect intelligence from high value targets, cybersecurity researchers warn.
asserted
researchers → begin → targets
New details are emerging of the sprawling spy operation within U.S. borders, with cybersecurity tech company CrowdStrike claiming it is finding one or two suspected North Korea IT worker cases every single day.
asserted
it → emerge → cases
The scheme is creating a heightened espionage foothold inside American companies spanning multiple industries with CrowdStrike claiming it has seen remote IT workers hand off access to malware teams when North Korea identifies intelligence worth collecting — and federal cases show overseas workers gaining access to sensitive U.S. military technology.
asserted
workers → create → technology
"They don't discriminate," Adam Meyers, CrowdStrike's head of counter adversary operations, told Fox News Digital, explaining that the workers apply broadly across industries, from consumer companies to defense contractors.
asserted
workers → discriminate → contractors
But when they land inside a "particularly juicy target," Meyers said, CrowdStrike has seen the operation handed off to a malware team "because they realize that there's some intelligence value and something that they want to collect."
Meyers did not say whether the malware teams successfully collected sensitive information after those handoffs.
The FBI is now warning that the scheme poses a "significant national security and intellectual property theft insider threat."
North Korean workers are targeting cleared defense contractors, jobs that require U.S. government security clearances and even active-duty military personnel who can host company laptops.
Recent federal cases illustrate the stakes — from a worker who successfully accessed controlled technical information at an AI defense contractor to impostors who secured offers for jobs involving military AI and Top Secret intelligence.
In one case involving a network of U.S.-based "laptop farms" that helped overseas workers obtain remote jobs at more than 100 American companies, prosecutors identified a California defense contractor developing AI-powered equipment and technologies.
asserted
prosecutors → land → equipment
An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment.
uncertain
worker → use → indictment
Instead of going to the purported employee, the company laptop was shipped to a conspirator in New Jersey and ultimately transferred to a laptop farm, where software allowed the overseas worker to operate it remotely.
asserted
worker → go → it
For more than two months, prosecutors said, the worker accessed the contractor's systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR.
asserted
worker → say → Regulations
The indictment said documents obtained from victim companies included information related to "sensitive U.S. military technology."
asserted
documents → say → technology
The same contractor hired two other overseas workers using stolen American identities within roughly six weeks, prosecutors said.
asserted
prosecutors → hire → weeks
Their laptops were also routed through U.S.-based facilitators for remote access.
asserted
laptops → rout → access
A separate case unsealed last week shows operatives pursuing positions with even more explicit national security ties.
asserted
case → unseal → ties
Overseas conspirators were allowed to use the identity of a Virginia man who worked for a cleared defense contractor and held an active Top Secret security clearance.
asserted
who → allow → clearance
One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military.
asserted
impostor → secure → military
The company shipped a laptop to the Virginia man's home before discovering during a video call that the purported employee did not match the person whose identity he was using.
asserted
he → ship → identity
Another impostor using the same identity was offered a $170,000 senior software engineering position requiring Top Secret/Sensitive Compartmented Information clearance.
asserted
impostor → use → clearance
That company caught the scheme before work began after a background investigation uncovered discrepancies and a video call revealed someone who appeared roughly 30 years younger than the man whose identity he was using.
asserted
he → catch → identity
Neither impostor ultimately performed the sensitive work.
asserted
impostor → perform → work
But the cases show how far the operation has reached into companies handling military technology and positions requiring some of the government's highest security clearances.
asserted
operation → show → clearances
CrowdStrike began tracking the North Korean IT worker campaign it calls "Famous Chollima" in March 2024 after investigating what initially appeared to be a single malicious insider.
asserted
what → begin → March
Investigators soon identified dozens of other victims among its customers.
asserted
Investigators → identify → customers
Unlike traditional espionage operations targeting specific organizations, Meyers said, the workers cast a wide net, applying for hundreds or thousands of remote IT jobs.
asserted
workers → target → jobs
The primary objective is generating revenue for North Korea, according to CrowdStrike, which has linked Famous Chollima to the country's Munitions Industry Department.
uncertain
which → generate → Department
Meyers said the money helps fund North Korea's weapons program.
asserted
money → say → program
But access to a valuable target can create an additional intelligence opportunity.
asserted
access → create → opportunity
Treasury last week sanctioned another North Korean IT-worker network, saying the regime takes most of the workers' wages and generates hundreds of millions of dollars to fund its weapons of mass destruction and ballistic missile programs.
asserted
regime → sanction → destruction
Treasury also warned that workers have exploited corporate access to deploy malware, steal proprietary information and remove sensitive data.
"
asserted
workers → warn → data
The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said.
asserted
Bessent → target → payments
The operation relies on stolen identities, increasingly sophisticated deception and U.S.-based facilitators who provide the physical footprint overseas workers lack.
asserted
workers → rely → footprint
After a worker is hired, a company laptop can be shipped to a facilitator's home and configured for remote operation, making it appear to company systems that the employee is working inside the United States.
asserted
employee → hire → States
Artificial intelligence is also making the deception more sophisticated.
asserted
deception → make → ?
Meyers said operatives use AI to create convincing LinkedIn profiles and resumes, answer interview questions and increasingly alter their appearance on video calls.
asserted
operatives → say → calls
Some also use AI to help perform the jobs after being hired.
asserted
Some → use → jobs
The FBI says workers have purchased access to identity-verification services to test stolen identities, hired Americans to appear on camera or complete employment requirements and sometimes subcontracted entire jobs to other foreign workers.
asserted
workers → say → workers
The bureau also warned that workers "almost always" remove data from victim companies because many are required to record their screens to document daily work.
asserted
many → warn → work
Federal authorities have intensified efforts to dismantle the infrastructure supporting the operation.
asserted
authorities → intensify → operation
In October, the FBI searched more than 40 suspected laptop farms across Texas, seizing 187 laptops and other devices.
asserted
FBI → search → laptops
DOJ said coordinated actions announced that day affected more than 70 U.S. companies.
asserted
actions → say → companies
"This investigation is about far more than fraud," U.S. Attorney Ryan Raybould said.
asserted
Raybould → say → fraud
"It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders."
asserted
regime → infiltrate → borders
…and 5 more, not listed.
The Aporia
