A sophisticated scheme by North Korea to deploy fake IT workers within American companies has evolved into a significant threat, encompassing intelligence gathering and malware deployment, according to cybersecurity researchers. CrowdStrike, a cybersecurity technology company, reports discovering one to two suspected North Korean IT worker cases daily.
These operatives are infiltrating a wide range of U.S. companies, including defense contractors and firms working on artificial intelligence. When a worker gains access to a "particularly juicy target," the operation can be handed off to malware teams, though it remains unclear if sensitive information has been successfully collected in these instances. The FBI has warned that this operation poses a "significant national security and intellectual property theft insider threat."
North Korean workers are targeting roles that require U.S. government security clearances and even positions involving active-duty military personnel who use company laptops. Recent federal cases have highlighted the risks, with one worker gaining access to controlled technical information at an AI defense contractor. In another instance, impostors secured job offers involving military AI and Top Secret intelligence.
Federal prosecutors have identified cases where overseas workers used stolen American identities to gain employment. In one such case, a worker was hired as a remote software engineer by a California defense contractor developing AI-powered equipment. The company laptop was rerouted through a "laptop farm" in New Jersey, allowing the overseas worker remote access for over two months. During this period, the worker downloaded technical data, including material controlled under the International Traffic in Arms Regulations (ITAR), which pertains to sensitive U.S. military technology.
These operations are increasingly using advanced deception tactics, including AI-generated résumés and altered appearances on video calls. U.S.-based facilitators play a crucial role by providing a physical presence, receiving company laptops, and configuring them for remote operation by overseas workers. The FBI has also noted that workers "almost always" remove data from victim companies, often due to screen recording requirements to document their work.
Federal authorities have intensified efforts to dismantle the infrastructure supporting this operation. In October, the FBI searched over 40 suspected laptop farms across Texas, seizing hundreds of laptops and remote-access devices. These actions targeted over 70 U.S. companies.
The primary objective of this scheme, which CrowdStrike has dubbed "Famous Chollima," is to generate revenue for North Korea, reportedly funding its weapons program. The U.S. Treasury has sanctioned North Korean IT worker networks, stating that the regime siphons most of the workers' wages, generating hundreds of millions of dollars for its weapons programs. Treasury Secretary Scott Bessent stated that North Korea "continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments."