North Korea Expands Fake IT Worker Scheme, With CrowdStrike Finding 1-2 U.S. Cases Daily
Updated
Updated · Fox News · Nov 5
North Korea Expands Fake IT Worker Scheme, With CrowdStrike Finding 1-2 U.S. Cases Daily
3 articles · Updated · Fox News · Nov 5
Summary
CrowdStrike says North Korea’s fake remote-worker campaign has evolved from a cash-raising fraud into an espionage channel, with investigators spotting one or two suspected U.S. cases every day.
The workers apply broadly across industries, then hand access to malware teams when they land inside higher-value targets; the FBI says the operation poses a significant insider threat to national security and intellectual property.
Federal cases show the reach: one overseas worker spent more than two months inside a California defense contractor and downloaded ITAR-controlled technical data, while other impostors pursued $130,000 and $170,000 jobs tied to military AI and Top Secret work.
The scheme depends on stolen U.S. identities, domestic "laptop farms" and AI-assisted deception in resumes, interviews and video calls, allowing overseas operatives to appear as U.S.-based employees.
Treasury says the networks generate hundreds of millions of dollars for Pyongyang’s weapons programs, and an October FBI sweep of more than 40 sites seized 187 devices as authorities widened the crackdown.