North Korean Workers Target Defense Contractors

The FBI has warned defense contractors that North Korean IT workers are seeking jobs at cleared defense companies and other businesses with U.S. government contracts. The warning comes as the Defense Department's Cyber Crime Center, known as DC3, reports an unprecedented surge in insider-threat incidents.

Les Bernys, DC3's executive director, told reporters that insider cyber incidents reported in the previous six months far outpaced any other period the center has tracked. Critical incident reports from defense companies, including insider threats, rose by more than 50 percent in the last fiscal year. The agency couldn't provide complete figures because defense industrial base companies reporting incidents remain anonymous. That anonymity may hide the problem's true scale from public view.

Who Is Being Targeted

Bernys described two distinct kinds of insider incidents. One involves former Defense Department employees who acted maliciously on networks before leaving, or kept access to data and tried to take it out. The second is more unsettling. Companies discovered they had hired people they believed were Americans, only to learn they were North Korean. "These incidents aren't coming in huge numbers, but the increase is noticeable," Bernys said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. Companies, he said, were struggling to verify applicants, and the people hurt most are workers and firms least equipped to run deep background checks.

The FBI had already warned that North Korean schemes sought to finance the regime through remote IT work for U.S. companies. The Justice Department has now laid out the scale: it reported an indictment, two arrests, and searches of multiple known or suspected "laptop farms" in Texas under an operation called "Operation Lonestar Roundup." Investigators also seized approximately 187 computer devices used by North Korean IT workers.

The scheme ran from 2019 through 2025 and affected more than 70 U.S. company employers. The department estimated it generated approximately $3 million in revenue for IT workers, money it believes went to organizations controlled by North Korea. Companies in healthcare, communications, cyber support, retail and manufacturing in Ohio, 16 other states and the District of Columbia were affected. These are working businesses and their employees, not abstractions.

The Growing Reliance on Local Facilitators

The FBI said companies should look for multiple warning behaviors together when assessing applicants or activity on corporate networks. Examples include using remote-desktop software to connect to employment-related devices and frequently downloading applications unrelated to a person's job role onto work devices. The bureau said North Korean IT workers increasingly recruit American facilitators to evade improved private-sector detection and law-enforcement action. Those facilitators may take on a wider range of tasks, or the workers may subcontract entire jobs to third-party foreign nationals.

The FBI also said the groups target identities and facilitators with qualifications that help them pursue more jobs, including roles requiring U.S. government security clearances or specialized technical skills. They have targeted cleared defense contractors, other government contractors and active-duty U.S. military members to host laptops.

The Broader Pattern of Pressure

The Defense Counterintelligence and Security Agency, or DCSA, paints a wider picture in its fiscal 2025 annual report. Companies reported more than 22,000 suspicious contacts, and the agency identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology from cleared industry. Some entities tried to evade sanctions and compromise cleared employees.

Companies reported approximately 32,000 suspicious contact reports in 2024 and 28,000 in 2023, an increase of more than 7 percent over 2022. DCSA said more than 48 percent of targeted attempts in 2025 came from East Asia and the Pacific. The most common tactics were exploiting experts and submitting resumes. "Foreign entities frequently sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge and expertise," the agency said. It added that "exploitation of cyber operations also remained a significant methods of operation across multiple regions."

The Cybersecurity and Infrastructure Security Agency, or CISA, updated its Insider Threat Mitigation Guide in September 2026. The guide covers behavioral warning signs, hybrid and remote work, the use of artificial intelligence to deceive, visitor screening and risks tied to adverse employee separations. CISA put the cost of credential theft at about $4.8 million a year for each company and said containing an insider-threat incident takes an average of 81 days.

"Insider threats can be either intentional or unintentional. A significant portion of insider threats involve negligent or accidental behaviors," CISA wrote. The agency stressed there is no "one-size-fits-all" approach and recommended multiple complementary, case-specific measures that are respectful and prevention-focused. Its guidance calls for balancing protection of the organization with care for individuals.

Why This Matters: The numbers point to a problem that falls hardest on public institutions and workers at the center of the defense system. Every fraudulent hire represents a breach of trust. Every stolen credential carries a real cost for the companies that absorb it. Because the defense industrial base reports anonymously, the public and lawmakers have limited ability to judge how deep the exposure runs. Accountability depends on transparency, and transparency depends on federal agencies and companies sharing what they know. CISA's call to care for individuals, not just monitor them, reflects a view that effective security should protect workers as well as the systems they operate. Whether the government backs that approach with resources and clear reporting standards will shape how well the country defends the people and technology it relies on.