A campaign that initially appeared designed to bring money into North Korea by placing fake IT workers at U.S. companies may also be giving the regime a way to gather intelligence, cybersecurity researchers say.
CrowdStrike says it is uncovering one or two suspected North Korean IT worker cases on an almost daily basis. The activity has spread across American businesses in a range of industries, and researchers have seen workers pass access to malware teams when they encounter information North Korea may want.
Adam Meyers, who leads CrowdStrike’s counter-adversary operations, said the workers apply to employers across the board, including consumer businesses and defense contractors. If they reach a particularly valuable target, he said, the operation may be handed to a malware team to pursue intelligence of interest. Meyers did not say whether those teams had managed to obtain sensitive material.
The FBI has described the scheme as a significant national security and intellectual property threat. North Korean operatives have sought jobs with cleared defense contractors and positions involving U.S. government security clearances. Some have also tried to recruit active-duty service members to host company laptops.
Recent court cases illustrate the risks. In one investigation, prosecutors described a U.S.-based network of laptop farms that helped overseas workers obtain remote jobs at more than 100 American companies. Among the employers was a California defense contractor developing AI-enabled equipment and technology.
According to an indictment, an overseas worker using a stolen U.S. identity was hired as a remote software engineer in January 2024. The company sent the laptop to a conspirator in New Jersey, who routed it to a laptop farm. There, software enabled the worker to operate the machine from abroad.
Prosecutors said the worker accessed the contractor’s systems for more than two months and downloaded technical material, including information controlled under the International Traffic in Arms Regulations, or ITAR. Documents recovered from affected companies included data related to sensitive U.S. military technology, the indictment said.
The same contractor hired two more overseas workers using stolen American identities within about six weeks, prosecutors said. Their computers were likewise sent through U.S.-based facilitators so they could be accessed remotely.
A separate case made public last week involved attempts to obtain jobs with especially direct national security connections. Overseas conspirators were permitted to use the identity of a Virginia man who worked for a cleared defense contractor and held an active Top Secret clearance.
One person using that identity received a $130,000 software engineering offer from a government contractor working on a generative AI project for a U.S. military component. The company sent a laptop to the Virginia man’s home, but during a video call it became clear that the person claiming to be the employee was not the man whose identity he had taken.
Another impostor using the same identity was offered a senior software engineering job paying $170,000. The role required Top Secret/Sensitive Compartmented Information clearance. The company stopped the hiring process after a background check found inconsistencies and a video call showed someone who appeared to be about 30 years younger than the actual identity holder.
Neither person ultimately carried out the sensitive work. Still, the cases show the campaign reaching employers responsible for military technology and jobs requiring some of the government’s highest-level clearances.
CrowdStrike began tracking the campaign, which it calls “Famous Chollima,” in March 2024. The investigation began with what appeared to be one malicious insider; researchers later found dozens of other affected customers.
Rather than focus on a short list of organizations, the workers cast a wide net, Meyers said, applying for hundreds or even thousands of remote IT jobs. CrowdStrike says the campaign’s main purpose is to generate revenue for North Korea and has linked it to the country’s Munitions Industry Department. Meyers said the proceeds help finance the North Korean weapons program.
Access to a particularly useful employer, however, may offer another benefit. The U.S. Treasury Department last week sanctioned a separate North Korean IT-worker network, saying the government takes most of the workers’ earnings and raises hundreds of millions of dollars for weapons of mass destruction and ballistic missile programs.
Treasury also said the workers have used their access to deploy malware, take proprietary information and remove sensitive data. Secretary Scott Bessent said North Korea’s overseas operatives target U.S. companies through fraud, then use sensitive information to pressure businesses for large payments.
The operation depends on stolen identities, increasingly convincing deception and U.S.-based helpers who provide a physical presence for workers operating overseas. Once someone is hired, a company laptop may be sent to a facilitator’s home and set up for remote use, making it appear to the employer’s systems that the employee is working from within the United States.
Artificial intelligence is adding to the challenge. Meyers said operatives use AI to build credible résumés and LinkedIn profiles, prepare for interviews and, increasingly, change their appearance during video calls. Some also turn to AI tools to help complete their work after being hired.
The FBI says workers have obtained access to identity-checking services to test stolen identities. They have also paid Americans to appear on camera or meet employment requirements, and in some cases subcontracted whole jobs to other foreign workers.
The bureau has warned that workers “almost always” take data from victim companies. Many employers require staff to record their screens as a way to document their daily work, creating an opportunity to capture company information, the FBI said.
Federal authorities have stepped up efforts to disrupt the networks supporting the scheme. In October, the FBI searched more than 40 suspected laptop farms in Texas and seized 187 laptops and other devices. The Justice Department said coordinated actions announced that day affected more than 70 U.S. companies.
U.S. Attorney Ryan Raybould said the investigation involved more than employment fraud, describing it as an effort by a hostile foreign government to enter American companies using stolen identities and covert access points inside the country.
Meyers said CrowdStrike identified laptop farms by comparing patterns across cases and shared information with the FBI. That work contributed to searches and arrests involving U.S.-based facilitators, he said.
North Korean operatives have also impersonated recruiters to approach people who already work inside companies. In a separate cryptocurrency theft investigation, Binance said a software engineer was contacted through a legitimate job platform by someone claiming to represent an executive at a fictitious company. The exchange suspected the approach was part of an effort to compromise employees through sham interviews.
Meyers said employers should treat identity checks as part of their security work, not just a hiring procedure, and make sure recruiters and security staff know what tactics to watch for.
Once someone passes the hiring process, Meyers noted, that person can have the same access as any other employee. In some cases, he said, that could include a company’s most valuable systems and information.
