North Korean Hiring Schemes Target Cleared U.S. Firms

The FBI warned that North Korean IT workers are seeking jobs at cleared defense companies and other businesses with U.S. government contracts, while the Defense Department Cyber Crime Center reported a record number of insider-threat incidents. The warnings have placed sensitive government work and the companies carrying it out at the center of growing counterintelligence concerns.

Threats Inside the Contractor Network

Les Bernys, DC3’s executive director, said reports of insider cyber incidents over the previous six months far exceeded those from any other period in the center’s history. Critical incident reports from defense companies, including insider threats, climbed by more than 50% in the last fiscal year. DC3 said it couldn’t provide complete figures because reporting defense industrial base companies remain anonymous.

Bernys described two types of insider incidents. Some former Defense Department employees acted maliciously on networks before leaving, or kept access to data and tried to exfiltrate it. In other cases, companies discovered they’d hired people they believed were Americans but who were North Korean. “These incidents aren't coming in huge numbers, but the increase is noticeable,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. Companies, he said, struggled to verify applicants.

The FBI had recently warned that North Korean schemes sought to finance the regime through remote IT work for U.S. companies. The Justice Department reported an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas under “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by North Korean IT workers.

The department said the scheme operated from 2019 through 2025, affected more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. Officials believed the revenue went to organizations controlled by North Korea. Affected companies in healthcare, communications, cyber support, retail and manufacturing were located in Ohio, 16 other states and the District of Columbia.

Access to Cleared Work and Technology

The FBI said North Korean IT workers increasingly recruit American facilitators to counter better private-sector detection and law-enforcement actions. Workers may use facilitators for more tasks or subcontract entire jobs to third-party foreign nationals. The bureau said groups also use identities or facilitators with qualifications that help them pursue additional jobs, including roles requiring U.S. government security clearances or specialized technical skills.

Those groups have targeted cleared defense contractors, other government contractors and active-duty U.S. military members to host laptops. The FBI said companies should assess applicants and activity on corporate networks by looking for multiple behaviors together. These include using remote-desktop software to connect to employment-related devices and frequently downloading applications unrelated to a person's job role onto work devices.

The Defense Counterintelligence and Security Agency said companies reported more than 22,000 suspicious contacts in its fiscal 2025 annual report. It identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology from cleared industry. Some foreign entities tried to evade sanctions and compromise cleared employees.

DCSA defines suspicious contacts as contacts with roughly an even chance or higher likelihood of representing attempts by people of any nationality to gain illegal access to cleared facilities, classified information or technology, or to compromise cleared employees. Companies reported approximately 32,000 suspicious contact reports in 2024 and 28,000 in 2023, more than a 7% increase from 2022.

Agencies Detail Costs and Defensive Measures

DCSA said more than 48% of targeted attempts in 2025 came from East Asia and the Pacific. The most common tactics were exploiting experts and submitting resumes. Foreign entities frequently sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge and expertise, the agency said. It also said actors targeted public-facing websites, contractor networks and points of trust within organizational ecosystems.

DCSA said bad actors used resumes to seek emerging-technology jobs in U.S. academia and cleared industry, aiming for legitimate placement and proximity to defense research data, tools and professional networks. The agency described the cleared national industrial base—which includes academia, companies of all sizes and personnel who research, develop and field U.S. technologies—as a primary target that becomes more attractive as it produces innovative capabilities.

The Cybersecurity and Infrastructure Security Agency updated its Insider Threat Mitigation Guide in September 2026. CISA said the guide covers behavioral indicators of risk, hybrid and remote work, artificial intelligence used to manipulate or deceive, access control, visitor screening and risks arising from adverse employee separations. Credential theft costs each company about $4.8 million a year, CISA said, and containing an insider-threat incident takes an average of 81 days.

CISA said insider threats can be intentional or unintentional, with a significant portion involving negligent or accidental behaviors. Organizations face risks including sabotage, intellectual-property theft and cyberattacks, the agency said, and it recommended complementary, case-specific measures that balance organizational protection with care for individuals.