FBI Investigates North Korean Remote IT Worker Hired by US Federal Agency
The Federal Bureau of Investigation (FBI) is investigating how a North Korean national was hired to work for an unnamed United States federal government agency, marking a rare instance of a sanctioned operative penetrating a government department.
What Happened
According to reports originating from Federal News Network, a senior FBI official confirmed the inquiry during a conference on July 28 in Washington, D.C. The details regarding how the individual bypassed screening procedures remain undisclosed, and the specific federal agency involved has not been publicly named. When contacted by TechCrunch, the FBI declined to offer further comment. It is currently unconfirmed whether sensitive data, intellectual property, or funds were compromised during the individual’s employment.
Key Highlights
- Federal Inquiry: The FBI is actively investigating the hiring of a North Korean remote worker by an undisclosed U.S. federal agency.
- Rare Penetration: While thousands of North Korean IT workers are believed to have infiltrated private companies across the U.S. and Europe, stringent government vetting and security clearance protocols have traditionally kept them out of federal bodies.
- Past Precedents: In 2024, the U.S. Department of Justice charged a Maryland resident for helping a North Korean hacker pose as an American to secure a remote contractor role with the Federal Aviation Administration (FAA).
- Financial Motives: Blockchain forensic firms report that the North Korean regime was responsible for 76% of cryptocurrency thefts in 2025, generating at least $2 billion to help fund its sanctioned nuclear weapons program.
- Operational Network: The regime relies on overseas networks in Russia, China, and Pyongyang, alongside U.S.-based facilitators who establish laptop farms to make remote workers appear domestic.
Why This Matters
The case highlights vulnerabilities in remote hiring systems and identity verification. North Korea coordinates long-running employment schemes where IT personnel use fraudulent identities to obtain remote roles. These operatives funnel their earnings back to the regime, exfiltrate proprietary data, and attempt extortion when uncovered. While private sector multinational corporations have frequently been targeted, penetrating a federal entity poses distinct security concerns for government operations.
What to Watch Next
U.S. authorities continue enforcement actions targeting support networks across Pyongyang, China, and Russia, as well as domestic accomplices who facilitate laptop farms. Further updates may disclose the specific agency affected and whether regulatory changes will be introduced to tighten identity verification for federal contractors and employees.
Frequently Asked Questions
How do North Korean IT workers obtain these jobs?
Operatives exploit weaknesses in remote hiring processes by using stolen or fraudulent identities, often assisted by domestic facilitators who host fleets of laptops within the United States to disguise their true location.
Was any government data or money stolen?
Authorities have not confirmed which agency was targeted, and it is currently unknown whether any funds or government data were exfiltrated during the assignment.
Source: Based on reporting by Federal News Network and TechCrunch.