FBI Investigating North Korean Remote IT Staffer Working For US Agency

The FBI is investigating how an unidentified federal agency was recently swept up in a yearslong campaign involving North Korean remote IT workers fraudulently obtaining jobs at major companies and other organizations.

The North Korean campaign has been notorious for using remote IT contract jobs to infiltrate both Fortune 500 companies and smaller private sector firms.

But experts contacted for this story said it’s not surprising the public sector has been implicated as well. They said the incident highlights a new kind of insider threat, as well as potential gaps in the government and industry vetting processes, especially for jobs like IT support work.

During a panel discussion at a July 28 conference hosted by the Digital Government Institute in Washington, D.C., Todd Hemmen, deputy assistant director of the FBI’s Cyber Capabilities Branch, was asked whether the North Korean remote IT worker issue had impacted government.

“Without getting into ongoing investigations, we identified just this past week a [Democratic People’s Republic of Korea] remote IT worker that was working for the federal government,” Hemmen said. “Still kind of unpacking that recent case. It’s actually a little bit baffling to me, not understanding this particular agency’s process. But the short answer is yes, we are seeing remote IT workers not just in the private sector – although a vastly higher proportion in the private sector – but we’re also seeing this impact the government to a degree.”

The FBI declined to comment further on the story. It’s unclear what agency was impacted, how long the intrusion lasted, and whether any sensitive data was stolen.

It’s highly likely Hemmen was referring to a remote IT employee doing contract work on behalf of an agency, experts confirmed, given extensive background investigation and identity proofing requirements needed to get a federal job.

Such a case wouldn’t be unprecedented. Last year, a Maryland man was sentenced to 15 months in prison for allowing a North Korean national in China to work on software development contracts for the Federal Aviation Administration.

In a press release announcing the sentencing, the Justice Department said the man fraudulently gained work with at least 13 U.S. companies. Several of those companies contracted the man’s services to “U.S. government agencies in addition to the FAA,” the DoJ said, leading to several co-conspirators gaining access to “sensitive U.S. government systems” from China.

A former FBI official, asked about Hemmen’s comments, pointed to the widening scope of the North Korean campaign. The official requested anonymity to speak candidly.

“It’s a natural progression that they would try to get placement into government locations,” the former official said. “It is hard to say whether the alleged DPRK IT worker discovered working inside the federal government was the result of direct targeting or a target of opportunity. Either way, if true, it demonstrates capability and intent to gain access into the federal government.”

Donald Blersch, a former senior government official who now advises risk assessment firm Clearspeed, said such incidents point to gaps in support roles that don’t undergo the same vetting as other federal employees and contractors.

“If you’re a contractor supporting a company, even if you’re nowhere near the government contract itself, you may still have access to corporate networks, systems, and information that can ultimately provide a pathway into government environments,” Blersch said. “When those individuals aren’t vetted in a way comparable to the access they’re given, you’re potentially hiring a Trojan horse.”

On July 31, U.S. agencies and more than a dozen foreign partner agencies released a “global alert” regarding the risk North Korean remote IT workers pose to “private companies, governments, and individual citizens.”

Forged identities and laptop farms

Official warnings about the DPRK’s remote IT worker scheme go back to 2022. Federal investigators say the North Korean government has dispatched thousands of highly skilled IT workers across the world to gain fraudulent employment and gain revenue for weapons programs.

The campaign is believed to have placed workers in hundreds of companies. The United Nations estimates remote workers have generated between $250 million and $600 million annually for North Korea.

More recently, the FBI says North Korean IT workers have been observed using access to company networks to also steal sensitive and proprietary data, as well as sensitive IT credentials and other information that could be used in further cyber attacks.

Officials say the workers are often skilled in key technology areas like software and blockchain applications. They use forged and stolen identities, and crucially, third-party collaborators for legitimate addresses, bank transfers, “laptop farms” and other assistance.

Several U.S. nationals have been sentenced in recent months for their roles in aiding North Korean remote IT workers.

Artificial intelligence is also increasingly central to the campaign’s success. During the July conference, Hemmen said AI is helping remote IT workers create resumes and identity documents. He said it’s also used during video interview processes and in remote meetings to generate convincing deepfakes and quickly do research to be a more effective worker.

“We’re seeing AI use across that entire spectrum of the DPRK remote worker, from application to employment,” Hemmen said.

Understanding ‘red flags’

The remote IT worker risk is referenced heavily in a recent white paper published by the Intelligence and National Security Alliance. The paper pushes for strengthening identity verification procedures across support staff who don’t go through the same vetting as security clearance holders.

“The resulting damage from imposters infiltrating other sectors critical to the national security ecosystem should be fair warning of the potential risks to our more sensitive government networks, where malicious actors could attempt to use similar tactics to work on classified programs,” the paper states.

Blersch and Lorna Macfarlane, who co-authored the paper alongside other INSA members, said recent incidents involving North Korean remote IT workers should serve as a call to action for government and industry.

Macfarlane said there may still be an “awareness gap” for many companies used to relying on remote support for IT, financial and other functions.

“Whether a bad actor’s intent is to earn a paycheck to fund a weapons of mass destruction program or gain access to sensitive or proprietary information, it’s important organizations take action now to strengthen every component of their hiring process to prevent these schemes from happening,” Macfarlane said.

Megan Mocho, a partner with the law firm Holland & Knight, said companies that don’t properly vet remote workers who handle sensitive data could already face a range of data security and privacy issues, as well as False Claims Act risks.

But she said spreading awareness and lessons learned about incidents like the North Korean remote IT workers is crucial, so companies can tailor their internal controls to address the evolving risks.

“I’ve represented companies that have been targeted,” Mocho said. “They were alerted to that person and were able to remove them or the person had already been removed, but then subsequently, the company is targeted by new individuals. Well, thankfully the company had lessons learned and so knew what to look for, knew how to do interview validation, knew how to validate their resume, and check their profile integrity.”

The recent INSA white paper recommends the government establish a joint working group under the Defense Counterintelligence and Security Agency to establish new standards and models for defending against modern social engineering and synthetic identity threats.

“This is a great example of when it’s imperative for organizations of any size who work in any sector to perform a risk assessment of existing controls to identify where some of those gaps may exist and revise where necessary to account for vulnerabilities,” Macfarlane said.

Blersch argued stronger identity checks should be expanded from national security jobs to support positions across government and critical sectors that enable access to sensitive systems and data.

“The objective isn’t to clear everyone, but to know with confidence who you’re trusting with critical access,” he said.

The former FBI official agreed agencies should consider expanding aspects of the cleared hiring process to other work roles, with measures including fingerprinting, requiring multiple methods of identity verification, and requiring proof of education or prior employment.

“This is essentially risk in the personnel supply chain,” the official said. “How deep do you need to go to vet the people performing work critical to your business, where do you want to make a risk-based decision, and what does that risk-based decision start to look like?”

Mocho said it will be crucial to eventually get more information about the investigation referenced by Hemmen so organizations can understand how the North Korean remote IT worker was able to get past government and industry verification processes.

“The only way that we are going to get better as a community in preventing unauthorized access is to have transparency around what sort of tactics these individuals are using and transparency with specificity,” Mocho said. “My biggest question is certainly understanding what, if any, red flags were available to be caught because we need to train ourselves to be vigilant about these red flags.”