N. Korean IT Workers Target Cleared Defense Firms

The FBI warned defense contractors that North Korean IT workers are seeking jobs at companies with security clearances and other businesses holding U.S. government contracts. The warning comes as the Defense Department Cyber Crime Center, known as DC3, reports a record number of insider-threat incidents. Its executive director says the numbers are climbing fast.

Les Bernys, who leads DC3, said insider cyber incidents reported in the previous six months outpaced every other period in the center’s history by a wide margin. Critical incident reports from defense companies, including insider threats, rose by more than 50% in the last fiscal year. Yet DC3 can’t provide complete figures because defense industrial base companies reporting incidents remain anonymous. The data gap is itself a problem. Nobody can say with confidence how large this has become.

Two Kinds of Insider Threat

Bernys described two distinct categories of incidents. The first involves former Defense Department employees who acted maliciously on networks before leaving, or kept access to data after their departure and tried to take it. The second is stranger and, in some ways, more troubling. Companies have discovered they hired people they thought were Americans, only to learn the workers were North Korean. “These incidents aren’t coming in huge numbers, but the increase is noticeable,” Bernys said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. He said companies are struggling to verify who they’re actually hiring.

The Scheme and the Crackdown

The Justice Department has laid out the operation’s scope. It reported an indictment, two arrests, and searches of multiple known or suspected “laptop farms” in Texas under an effort called “Operation Lonestar Roundup.” Investigators also seized approximately 187 computer devices used by North Korean IT workers. According to the department, the scheme ran from 2019 through 2025, touched more than 70 U.S. company employers and generated approximately $3 million in revenue for the IT workers. The department believes that money flowed to organizations controlled by North Korea, meaning American paychecks quietly financed a hostile regime’s programs. Companies in healthcare, communications, cyber support, retail and manufacturing in Ohio, 16 other states and the District of Columbia were affected.

The FBI’s advice to businesses is practical rather than sweeping. It said companies should look for multiple behaviors together when assessing applicants or activity on corporate networks. Examples include using remote-desktop software to connect to employment-related devices and frequently downloading applications unrelated to a person’s job onto work machines. The bureau also said North Korean workers increasingly recruit American facilitators to get around improved private-sector detection, and may subcontract entire jobs to foreign nationals. Groups have targeted cleared defense contractors, other government contractors and active-duty U.S. military members to host laptops.

The Broader Espionage Picture

The Defense Counterintelligence and Security Agency’s fiscal 2025 annual report paints a wider picture. Companies reported more than 22,000 suspicious contacts, and the agency identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology from cleared industry. Some entities, the agency said, tried to evade sanctions and compromise cleared employees. Companies filed approximately 32,000 suspicious contact reports in 2024 and 28,000 in 2023, marking more than a 7% increase over 2022.

The agency said more than 48% of targeted attempts in 2025 came from East Asia and the Pacific. The most common tactics were exploiting experts and submitting resumes. “Foreign entities frequently sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge and expertise,” the agency said. It added that cyber operations remained a significant form of exploitation across multiple regions, with actors targeting public-facing websites, contractor networks and points of trust. Bad actors used resumes to seek emerging-technology jobs in U.S. academia and cleared industry, aiming to get close to defense research data and tools.

The Cybersecurity and Infrastructure Security Agency updated its Insider Threat Mitigation Guide in September 2026. CISA said credential theft costs each company about $4.8 million a year, and containing an insider-threat incident takes an average of 81 days. The agency stressed that many insider threats are unintentional. “A significant portion of insider threats involve negligent or accidental behaviors,” CISA wrote. It also said there’s no “one-size-fits-all” approach, recommending multiple case-specific measures that balance organizational protection with care for individuals.

Why This Matters:

The fiscal math is uncomfortable for every company holding a federal contract. CISA’s estimate of $4.8 million a year in credential theft costs per company directly drains margins at defense firms already operating under tight constraints, while the 81-day average for containment means damage builds long before most firms can respond. The national security stakes are plainer still. When a hostile state can place operatives inside cleared facilities and earn revenue for its weapons programs, the threat is no longer abstract. Taxpayers pay for these contracts, and the companies performing them carry responsibility for vetting their own workforces. The central lesson from the FBI and DCSA is that private firms must take ownership of hiring verification and network monitoring, since they’re the first and often only line of defense. Government can share intelligence and prosecute facilitators, but the front door belongs to the employer.