North Korea's Fake IT Worker Scheme Shifts From Cash Grab to Espionage, Researchers Warn

A scheme that planted fake North Korean IT workers inside American companies to generate cash has evolved into an intelligence-gathering operation, cybersecurity researchers warn, with CrowdStrike now finding one or two suspected cases every day.

"They don't discriminate," Adam Meyers, CrowdStrike's head of counter adversary operations, told Fox News Digital, saying the workers apply across industries, from consumer companies to defense contractors. When one lands inside a "particularly juicy target," he said, the operation is handed to a malware team "because they realize that there's some intelligence value and something that they want to collect." He did not say whether those handoffs succeeded.

The FBI now calls the scheme a "significant national security and intellectual property theft insider threat," warning that workers are pursuing cleared defense contractors, jobs requiring U.S. government security clearances, and even active-duty military personnel who can host company laptops.

Federal cases show the stakes. In one case involving U.S.-based "laptop farms" that helped overseas workers land remote jobs at more than 100 American companies, a California defense contractor developing AI-powered technologies hired an overseas worker using a stolen American identity as a full-time remote software engineer in January 2024. The company laptop was shipped to a conspirator in New Jersey and ended up at a laptop farm, where software let the worker operate it from overseas.

For more than two months, prosecutors said, the worker accessed the contractor's systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations and documents related to "sensitive U.S. military technology." The same contractor hired two more overseas workers using stolen identities within roughly six weeks.

A separate case unsealed last week shows even more explicit national security ties. Operatives used the identity of a Virginia man who worked for a cleared defense contractor and held an active top secret clearance. One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military before a video call exposed the mismatch. Another won a $170,000 senior engineering offer requiring a top secret clearance, but a background investigation and a video call showing someone roughly 30 years younger gave it away. Neither performed the sensitive work.

CrowdStrike began tracking the campaign, which it calls Famous Chollima, in March 2024 and has linked it to North Korea's Munitions Industry Department. Meyers said the workers apply for hundreds or thousands of remote jobs, and while revenue for Pyongyang's weapons program is the primary objective, a valuable target creates an added intelligence opportunity. The Treasury Department last week sanctioned another IT worker network, saying the regime takes most wages and generates hundreds of millions of dollars for weapons of mass destruction and ballistic missile programs. Treasury Secretary Scott Bessent said the operatives "weaponize sensitive data and extort businesses for substantial payments."

The operation relies on stolen identities and U.S.-based facilitators who receive company laptops and configure them for remote access. Meyers said operatives also use AI to build convincing LinkedIn profiles, answer interview questions and alter their appearance on video calls. The FBI says workers have hired Americans to appear on camera, subcontracted entire jobs and "almost always" remove data because many must record their screens.

In October, the FBI searched more than 40 suspected laptop farms across Texas and seized 187 laptops and other devices; the Justice Department said the actions affected more than 70 U.S. companies. "This investigation is about far more than fraud," U.S. Attorney Ryan Raybould said. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders." Meyers said CrowdStrike passed laptop farm leads to the FBI. He urged companies to treat identity verification as a security issue, not just hiring: "They're an employee, so they have access to whatever an employee would have. And that could be .. the crown jewels."