Defense Contractors Face $3 Million North Korean Scheme

A North Korean IT-worker scheme brought in approximately $3 million from jobs at more than 70 U.S. companies, with money believed to have gone to organizations controlled by North Korea, the Justice Department said. The FBI has warned that North Korean IT workers are seeking jobs with cleared defense companies and other businesses holding U.S. government contracts.

Who Got the Revenue

The Justice Department said the scheme operated from 2019 through 2025 and affected companies in healthcare, communications, cyber support, retail and manufacturing in Ohio, 16 other states and the District of Columbia. In its enforcement actions, the department brought an indictment, made two arrests, searched multiple known or suspected “laptop farms” in Texas under “Operation Lonestar Roundup,” and seized approximately 187 computer devices used by North Korean IT workers.

The FBI said North Korean workers increasingly recruit American facilitators as private-sector detection and law-enforcement actions improve. Facilitators may handle more tasks, or workers may subcontract entire jobs to third-party foreign nationals. Groups use identities or facilitators with qualifications that let them pursue more work, including positions requiring U.S. government security clearances or specialized technical skills, the FBI said.

The workers have targeted cleared defense contractors, other government contractors and active-duty U.S. military members to host laptops. Watch for combinations of behaviors, the FBI warned, including remote-desktop connections to employment-related devices and frequent downloads of applications unrelated to a person’s job onto work devices.

The Cost to Cleared Industry

The Defense Department Cyber Crime Center, or DC3, said companies reported a record number of insider-threat incidents. Les Bernys, DC3’s executive director, said reported insider cyber incidents in the previous six months far outpaced any other period in the center’s history. Critical incident reports from defense companies, including insider threats, rose by more than 50% in the last fiscal year. DC3 couldn’t provide complete figures because reporting companies are anonymous.

Bernys described former Defense Department employees who acted maliciously on networks before leaving or kept access to data and tried to exfiltrate it. He also described companies discovering that people they believed were Americans were North Korean. “These incidents aren’t coming in huge numbers, but the increase is noticeable,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. He said companies were struggling to verify applicants.

The Defense Counterintelligence and Security Agency said companies reported more than 22,000 suspicious contacts in fiscal 2025. The agency identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology from cleared industry. More than 48% of targeted attempts came from East Asia and the Pacific. The most common tactics were exploiting experts and submitting resumes.

Government Warnings and Workplace Measures

DCSA said foreign entities sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge. It also reported attempts to place people in emerging-technology jobs in U.S. academia and cleared industry, seeking proximity to defense research data, tools and professional networks. The agency calls the cleared national industrial base—which includes academia, companies and personnel who research, develop and field U.S. technologies—a primary target.

The Cybersecurity and Infrastructure Security Agency updated its Insider Threat Mitigation Guide in September 2026. The guide covers behavioral indicators, hybrid and remote work, artificial intelligence used to manipulate or deceive, access control, visitor screening and risks from adverse employee separations. CISA said credential theft costs each company about $4.8 million a year, while containing an insider-threat incident takes an average of 81 days.

Insider threats can be intentional or unintentional, CISA wrote, and a significant portion involve negligent or accidental behavior. The agency recommends complementary, case-specific measures that balance organizational protection with care for individuals. There’s no “one-size-fits-all” approach.