North Korean cyber operatives are infiltrating U.S. companies by posing as remote IT workers, stealing intellectual property and gathering military intelligence, cybersecurity firm CrowdStrike warned. The scheme creates a covert espionage foothold inside American firms.
National Security Threat
CrowdStrike now detects one or two suspected North Korean IT worker cases each day, with workers applying across consumer, defense and other sectors. The workers cast a wide net, applying for thousands of remote IT jobs.
The operation hands access to malware teams when intelligence is valuable, federal cases show. It also creates an insider threat to national security and intellectual property.
The FBI warns the scheme poses a significant national security and IP theft insider threat.
North Korean workers target cleared defense contractors and even active‑duty military personnel who can host company laptops.
Recent indictments show a worker at an AI defense contractor accessed controlled technical data and downloaded ITAR‑restricted material. Impostors also secured top‑secret AI and intelligence positions.
Prosecutors say a network of U.S.-based laptop farms routed company laptops to facilitators in New Jersey, allowing overseas operatives to work remotely for more than two months and exfiltrate sensitive military technology.
In another case, a stolen identity obtained a $130,000 software engineering role at a cleared defense contractor, only to be uncovered when a video call revealed the impostor was decades younger.
A separate scheme offered a $170,000 senior software position requiring top‑secret clearance; the employer detected discrepancies before work began.
Federal Crackdown
CrowdStrike began tracking the campaign, dubbed Famous Chollima, in March 2024 after mistaking it for a single insider. It has since linked the operation to North Korea’s Munitions Industry Department.
The workers generate revenue for Pyongyang, funneling wages into its weapons program.
Treasury last week sanctioned another North Korean IT‑worker network, noting the regime extracts hundreds of millions of dollars to fund weapons of mass destruction.
Treasury warned operatives exploit corporate access to deploy malware, steal proprietary data and extort businesses for large payments, Treasury Secretary Scott Bessent said.
The operation relies on stolen identities, sophisticated deception and U.S.-based facilitators who provide the physical footprint overseas workers lack.
After hiring, a laptop can be shipped to a facilitator’s home, configured for remote use, making the employer believe the employee works on U.S. soil.
Artificial intelligence now sharpens the deception: operatives use AI to craft convincing LinkedIn profiles, answer interview questions and alter appearance on video calls, while some employ AI to perform job duties after hire.
The FBI says workers purchase identity‑verification services, hire U.S. actors for camera appearances and sometimes subcontract work to other foreign laborers.
Authorities intensified efforts; in October the FBI seized 187 laptops and devices from more than 40 suspected laptop farms in Texas, affecting over 70 U.S. companies.
U.S. Attorney Ryan Raybould emphasized the probe is about a hostile foreign regime infiltrating American firms through stolen identities and covert access points inside our borders.
CrowdStrike has shared laptop‑farm patterns with the FBI, leading to searches and arrests of U.S. facilitators.
North Korean operatives also pose as recruiters to target employees already inside companies, as seen in a Binance cryptocurrency theft probe where a fake executive approached a software engineer.
Experts urge firms to treat identity verification as a security issue, train recruiters and security teams to spot these tactics, because a successful hire grants access to the crown jewels.
