A rare case has exposed how North Korean IT networks may have reached deeper into US institutions than officials previously acknowledged.<\/p>\n
The U.S. Federal Bureau of Investigation is investigating the possible employment of a North Korean citizen at an unnamed federal government agency. The case became known after a senior FBI official spoke at a conference in Washington on July 28.<\/p>\n
A bureau representative confirmed that a worker from North Korea had been engaged by one of the U.S. federal agencies. However, it has not been publicly disclosed how the individual passed the hiring process, which agency was affected by the incident, or whether the worker gained access to funds, official data, or other internal systems.<\/p>\n
FBI Investigates North Korean Worker\u2019s Infiltration of U.S. Government Sector<\/p>\n
The case is one of the few confirmed examples in which a worker from North Korea, which is subject to U.S. sanctions, managed to obtain a job within a U.S. government institution. For many years, U.S. authorities have warned about schemes in which North Korean IT specialists use forged or stolen personal information to secure remote positions.<\/p>\n
Such workers most often seek employment at private companies and multinational corporations. According to U.S. authorities, thousands of North Korean IT specialists may have obtained jobs at organizations in the United States and Europe by exploiting weaknesses in candidate screening procedures.<\/p>\n
The money they earn may be sent to Pyongyang. In addition, access to corporate infrastructure can create risks of data theft, intellectual property theft, and subsequent extortion of companies.<\/p>\n
Previous Cases Involving Employment Schemes for North Korean IT Specialists<\/p>\n
The U.S. government sector generally has stricter personnel screening procedures and security clearance requirements. However, similar incidents have already been reported.<\/p>\n
In 2024, the U.S. Department of Justice charged a Maryland resident. According to investigators, he helped a North Korean hacker pose as a U.S. citizen and work remotely as a contractor for the Federal Aviation Administration.<\/p>\n
The United States has repeatedly imposed sanctions and taken law enforcement action against North Korean networks operating through Pyongyang, Russia, and China. U.S.-based intermediaries who helped organize so-called laptop farms have also been sanctioned. These arrangements allow North Korean workers to appear as though they are working directly from the United States.<\/p>\n
Cyberattacks and Funding for Pyongyang\u2019s Programs<\/p>\n
North Korea also obtains funds through cyberattacks, including cryptocurrency theft. The Kim Jong Un regime directs these resources toward financing its internationally banned nuclear program.<\/p>\n
According to blockchain analytics firms, North Korea stole at least $2 billion in cryptocurrency in 2025. The FBI\u2019s investigation into the work of a North Korean IT employee at a federal agency is intended to determine the extent of possible access and the consequences of this incident for the security of U.S. government systems.<\/p>\n","protected":false},"excerpt":{"rendered":"A rare case has exposed how North Korean IT networks may have reached deeper into US institutions than…\n","protected":false},"author":2,"featured_media":115979,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[1147,59756,59755,31,154,34,59757,5951,59758],"class_list":["post-115978","post","type-post","status-publish","format-standard","has-post-thumbnail","category-north-korea","tag-cybersecurity","tag-fbi-investigation","tag-fbi-investigation-north-korean-it-workers-us-federal-agency-cybersecurity-north-korea-cyber-threats","tag-korea","tag-news","tag-north-korea","tag-north-korea-cyber-threats","tag-north-korean-it-workers","tag-us-federal-agency"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/115978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=115978"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/115978\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/115979"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=115978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=115978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=115978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}