USA11 August, 20263 min read
FBI Investigates North Korean Remote IT Worker Hired by U.S. Federal Agency
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
FBI investigating how North Korean remote IT worker was hired by unnamed US federal agency. Case highlights vetting gaps for remote IT support hires in government and industry.
FBI probes remote hire
The FBI is investigating how a North Korean national was able to secure a job at an unnamed U.S. federal government agency, a case first surfaced after a senior FBI official spoke at a conference in Washington on July 28. Federal News Network reported that the bureau is investigating a North Korean working for an unnamed federal agency, while TechCrunch said it is unclear how the individual was hired and whether any data or funds were stolen.
“‘Without getting into ongoing investigations, we identified just this past week a [Democratic People’s Republic of Korea] remote IT worker that was working for the federal government,’ Hemmen said.”
The Tech Buzz said the FBI confirmed a North Korean IT worker infiltrated a U.S. government agency as a remote employee, describing it as the first publicly documented instance of North Korean operatives breaching government systems through the remote workforce. Federal News Network also quoted Todd Hemmen, deputy assistant director of the FBI’s Cyber Capabilities Branch, saying, “we identified just this past week a [Democratic People’s Republic of Korea] remote IT worker that was working for the federal government,” and the FBI declined to comment further.
How it could happen
The Tech Buzz described a scheme in which North Korean operatives use stolen or fabricated U.S. identities to secure remote employment, sometimes with U.S.-based facilitators appearing on video calls while the actual worker remains overseas. Federal News Network said the incident highlights a new kind of insider threat and potential gaps in government and industry vetting processes, especially for jobs like IT support work, and it quoted a former FBI official saying, “It’s a natural progression that they would try to get placement into government locations.”
Federal News Network also quoted Donald Blersch, a former senior government official who now advises risk assessment firm Clearspeed, warning that contractors supporting a company can still have access to corporate networks, systems, and information that can provide a pathway into government environments. TechCrunch said strict vetting and security clearance practices have largely kept the regime’s hackers out of government “— though, not without incident,” pointing to a 2024 Justice Department case involving a Maryland man who helped a North Korean hacker pose as an American to get a remote job as a contractor for the Federal Aviation Administration.
Security stakes and fallout
The Tech Buzz said the FBI’s confirmation raises urgent questions about screening processes across both public and private sectors, noting that similar infiltrations have hit “private organizations and crypto exchanges.” Federal News Network reported that on July 31, U.S. agencies and more than a dozen foreign partner agencies released a “global alert” regarding the risk North Korean remote IT workers pose to “private companies, governments, and individual citizens,” and it said official warnings about the DPRK’s remote IT worker scheme go back to 2022.
“On July 31, U.S. agencies and more than a dozen foreign partner agencies released a‘global alert’regarding the risk North Korean remote IT workers pose to ‘private companies, governments, and individual citizens.’”
TechCrunch said North Korea relies on hacks, including thefts of cryptocurrency, to fund its globally sanctioned nuclear weapons program, and it added that the Kim Jong Un regime is reportedly responsible for 76% of cryptocurrency thefts, netting the regime at least $2 billion during 2025. The Tech Buzz also framed the access gained as the real prize, saying a developer with admin credentials or access to proprietary code repositories can exfiltrate intellectual property, plant backdoors for future exploitation, or map network architecture for later attacks.