Koreatimes.Co.Kr North Korean IT Workers Target U.S. Firms Under False Identities
Article Content
- •North Korean IT workers are infiltrating U.S. firms under false identities.
- •The FBI and Justice Department report significant insider threat increases.
- •Authorities are investigating links between these workers' wages and North Korea's weapons programs.
The FBI has warned that North Korean IT workers are attempting to infiltrate U.S. defense contractors and other companies under false identities. This follows a significant increase in reported insider threats, with the Defense Cyber Crime Center noting a 50% rise in critical incident reports in the last fiscal year. The Justice Department recently indicted individuals involved in a scheme that has affected over 70 U.S. companies since 2019. Authorities have uncovered 'laptop farms' used by these workers to conceal their true locations while conducting remote work. The investigation highlights concerns that wages earned by these workers may fund North Korea's nuclear and missile programs. Police in South Korea are also investigating a case involving a suspected North Korean IT worker employed under a false identity, marking a first for such disclosures. The situation underscores the growing sophistication of North Korean cyber operations and their implications for national security.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Common questions
How many companies have been affected?
What actions are being taken against these threats?
What should companies do to protect themselves?
Continue Reading
US Disrupts North Korean Laptop Farms Generating $3 Million in Fraud The US Department of Justice has arrested two US nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, for their roles in a scheme that facilitated North Korean IT workers to obtain remote jobs at US companies using stolen identities. This operation, named 'Operation Lonestar Roundup', involved raids on…
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…