What began as a scheme to generate cash for North Korea by deploying fake IT workers at American companies has now turned into an opportunity to collect intelligence from high-value targets, cybersecurity researchers warn.

New details are emerging of the sprawling spy operation within U.S. borders, with cybersecurity tech company CrowdStrike claiming it is finding one or two suspected North Korea IT worker cases every day.

The scheme is creating a heightened espionage foothold inside American companies spanning multiple industries. And CrowdStrike claims it has seen remote IT workers hand off access to malware teams when North Korea identifies intelligence worth collecting. And federal cases show overseas workers gaining access to sensitive U.S. military technology.

«They don’t discriminate,» Adam Meyers, CrowdStrike’s head of counter adversary operations, told Digital, explaining that the workers apply broadly across industries, from consumer companies to defense contractors.

CHINA-LINKED HACKERS INFILTRATED US GOVERNMENT NETWORKS BEFORE FBI TAKEDOWN

But when they land inside a «particularly juicy target,» Meyers said, CrowdStrike has seen the operation handed off to a malware team «because they realize that there’s some intelligence value and something that they want to collect.»

Meyers did not say whether the malware teams successfully collected sensitive information after those handoffs.

The FBI is now warning that the scheme poses a «significant national security and intellectual property theft insider threat.»

North Korean workers are targeting cleared defense contractors, jobs that require U.S. government security clearances, and even active-duty military personnel who can host company laptops.

Recent federal cases illustrate the stakes, from a worker who successfully accessed controlled technical information at an AI defense contractor to impostors who secured offers for jobs involving military AI and Top Secret intelligence.

In one case involving a network of U.S.-based «laptop farms» that helped overseas workers obtain remote jobs at more than 100 American companies, prosecutors identified a California defense contractor developing AI-powered equipment and technologies.

An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment.

Instead of going to the purported employee, the company laptop was shipped to a conspirator in New Jersey and ultimately transferred to a laptop farm, where software allowed the overseas worker to operate it remotely.

For more than two months, prosecutors said, the worker accessed the contractor’s systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR. The indictment said documents obtained from victim companies included information related to «sensitive U.S. military technology.»

The same contractor hired two other overseas workers using stolen American identities within roughly six weeks, prosecutors said. Their laptops were also routed through U.S.-based facilitators for remote access.

A separate case unsealed last week shows operatives pursuing positions with even more explicit national security ties.

Overseas conspirators were allowed to use the identity of a Virginia man who worked for a cleared defense contractor and held an active top secret security clearance.

One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military. The company shipped a laptop to the Virginia man’s home before discovering during a video call that the purported employee did not match the person whose identity he was using.

HOW A FOREIGN GOVERNMENT HELPED ACCUSED SAUDI SPY’S FAMILY FLEE US AFTER OPENAI BUG SCANDAL

Another impostor using the same identity was offered a $170,000 senior software engineering position requiring top secret/sensitive compartmented information clearance.

That company caught the scheme before work began after a background investigation uncovered discrepancies and a video call revealed someone who appeared roughly 30 years younger than the man whose identity he was using.

Neither impostor ultimately performed the sensitive work. But the cases show how far the operation has reached into companies handling military technology and positions requiring some of the government’s highest security clearances.

CrowdStrike began tracking the North Korean IT worker campaign it calls Famous Chollima in March 2024 after investigating what initially appeared to be a single malicious insider. Investigators soon identified dozens of other victims among its customers.

Unlike traditional espionage operations targeting specific organizations, Meyers said, the workers cast a wide net, applying for hundreds or thousands of remote IT jobs.

The primary objective is generating revenue for North Korea, according to CrowdStrike, which has linked Famous Chollima to the country’s Munitions Industry Department. Meyers said the money helps fund North Korea’s weapons program.

But access to a valuable target can create an additional intelligence opportunity.

Treasury last week sanctioned another North Korean IT-worker network, saying the regime takes most of the workers’ wages and generates hundreds of millions of dollars to fund its weapons of mass destruction and ballistic missile programs.

Treasury also warned that workers have exploited corporate access to deploy malware, steal proprietary information and remove sensitive data.

«The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives who weaponize sensitive data and extort businesses for substantial payments,» Treasury Secretary Scott Bessent said.

The operation relies on stolen identities, increasingly sophisticated deception and U.S.-based facilitators who provide the physical footprint overseas workers lack.

After a worker is hired, a company laptop can be shipped to a facilitator’s home and configured for remote operation, making it appear to company systems that the employee is working inside the United States.

Artificial intelligence is also making the deception more sophisticated.

Meyers said operatives use AI to create convincing LinkedIn profiles and resumes, answer interview questions and increasingly alter their appearance on video calls. Some also use AI to help perform the jobs after being hired.

The FBI says workers have purchased access to identity-verification services to test stolen identities, hired Americans to appear on camera or complete employment requirements and sometimes subcontracted entire jobs to other foreign workers.

The bureau also warned that workers «almost always» remove data from victim companies because many are required to record their screens to document daily work.

Federal authorities have intensified efforts to dismantle the infrastructure supporting the operation.

In October, the FBI searched more than 40 suspected laptop farms across Texas, seizing 187 laptops and other devices. The DOJ said coordinated actions announced that day affected more than 70 U.S. companies.

«This investigation is about far more than fraud,» U.S. Attorney Ryan Raybould said. «It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.»

Meyers said CrowdStrike has identified laptop farms through patterns across multiple cases and passed information to the FBI, contributing to searches and arrests of U.S.-based facilitators.

North Korea has also exploited the other side of the hiring process, with operatives posing as recruiters to target employees already inside companies.

In a separate cryptocurrency theft investigation, Binance said a software engineer had been approached through a legitimate job platform by someone posing as an executive at a fictitious company, part of what it suspected was a North Korean effort to compromise employees through fake interviews.

Meyers said companies must treat identity verification as a security issue, not simply a hiring function, and train recruiters and security teams to recognize the tactics.

«They’re an employee, so they have access to whatever an employee would have,» Meyers said of workers who successfully get through the hiring process.

«And that could be … the crown jewels.»

north korea, fbi, national security, cybercrime, security, technology, politics

NEWYou can now listen to Fox News articles!

First lady Melania Trump and envoys from both Russia and Ukraine spoke from the White House on Thursday, hailing the ceasefire in the Russian-occupied Oleshky region as a potential «spark» for peace that lasts beyond a temporary regional ceasefire.

Advertisement

«We have chosen humanity over war,» the first lady said in a White House trilateral news conference with the two warring countries. «Undeniably, the lives of innocent people must transcend the division of war. I hope Oleshky inspires greater peace. Every significant transformation begins with a small spark.»

«Together, we can create something more enduring than a temporary ceasefire,» she added, calling Oleshky «a spark in a world of darkness capable of illuminating the best in humanity.»

INSIDE MELANIA TRUMP’S SECRET DIPLOMATIC ROLE IN THE RUSSIA-UKRAINE CEASEFIRE DEAL

Advertisement

Trump said she became aware of a humanitarian crisis in the region in September and directed her representative, Marc Beckman, to engage with Russia and Ukraine on her behalf. She said both countries agreed to work with her as an «exclusive intermediary» to establish a ceasefire in Oleshky and the surrounding Kherson region, deliver humanitarian aid and create a safe evacuation route for civilians.

Her remarks were followed by comments from Russian special envoy Kirill Dmitriev, who said Russian President Vladimir Putin appreciated President Donald Trump’s efforts to stop the fighting.

US WILL MEDIATE UPCOMING UKRAINE-RUSSIA TALKS IN ABU DHABI, WITKOFF SAYS

Advertisement

Leader of the Servant of the People political party of Ukraine, David Arakhamia, sitting side by side with Russia’s presidential envoy Kirill Dmitriev was a unique image at first lady Melania Trump’s remarks on the ceasefire in Oleshky at the White House in Washington, D.C., on Nov. 5, 2026. (Saul Loeb/AFP via Getty Images)

«President Putin also appreciates President Trump’s peacemaking effort and his team working on a peace plan to resolve Ukrainian crisis,» Dmitriev said in a rare moment of a Russian diplomat speaking at the White House. «President Trump has asked President Putin to support a number of initiatives on exchanging of prisoners, on releasing U.S. prisoners on humanitarian efforts. And President Putin supported those ideas and those initiatives.»

«And it’s very important that cooperation between Russia and Ukraine and Russia in the United States matters not only for our two nations, but for the entire world,» he continued. «Let us continue making great humanitarian contributions. We can together, let us build a future of peace, partnership and prosperity for the benefit of our families, our children and future generations.»

Advertisement

RUSSIA RELEASES AMERICAN TEACHER IMPRISONED ON UKRAINE MERCENARY CHARGES AFTER TRUMP PRESSED PUTIN

First lady Melania Trump, left, and civilians being evacuated from Oleshky, Ukraine, in October 2022 during the early days of the Russia-Ukraine war. (Umit Bektas/Reuters; Alexander Ermochenko/Reuters)

«Dear Melania, you saved and touched so many lives,» he concluded.

David Arakhamia, the leader of Ukrainian President Volodymyr Zelenskyy’s political party, called Melania Trump’s ceasefire the ‘biggest de-escalation since 2022,» when the war began.

Advertisement

UKRAINE’S ZELENSKYY OPEN TO FREEZING FRONT LINES IN CEASEFIRE WITH RUSSIA

«Madam first lady, I would like to thank you: You did an amazing job,» he said. «I think when everything started with you and your team, we had about 5% of people who believed in success, and 95% of skeptics who said it wasn’t going to work. Now, after it happened, it’s switched completely: 95% of the people believe that we can do things like that, and 5% are still skeptical.»

Peace is now a matter of when, not if, he added.

Advertisement

KUSHNER, WITKOFF SET FOR KYIV TALKS AFTER PUTIN MEETING IN US PUSH FOR PEACE

Signature page from Oleshky ceasefire agreement. (Provided to Fox News Digital)

Getting fearful Ukrainians out of the Russian-controlled city is an important step toward deciding how peace will be made and determining the long-term fate of the occupied territory of southern Ukraine.

«On the first day, people in the area did not believe it was happening,» Arakhamia said. «They stayed in their homes, waiting to see if the clock was ticking backward. The next day, they started walking around their homes. The day after that, they came to see their broken homes and find their belongings.

Advertisement

«This is really emotional to watch and supervise, to understand what we are doing,» he added. «I think we are creating momentum where both sides are learning the little mechanics of how to keep the peace when the peace comes.

«I would also like to sincerely thank you, from my heart, for doing this.»

Dmitriev attended the event and met with U.S. officials, sources told Reuters. Dmytro Lubinets, Ukraine’s human rights ombudsman, also attended the event.

Advertisement

Eric Mack is a breaking news reporter and writer Sunday through Thursday, 6 a.m. ET to 2 p.m. ET, with a particular interest in stories that lead the news cycle on politics, elections, foreign affairs and government.

melania trump, white house, russia, ukraine, donald trump

Cuando un murciélago caza de noche, localiza a sus presas mediante ecos que el oído humano no percibe. Algunas polillas esfinge responden con sonidos aún más agudos. Para producirlos, los machos frotan escamas de sus estructuras genitales contra el abdomen y emiten ultrasonidos.

La capacidad de producir esa defensa apareció de manera independiente hasta siete veces en la evolución de estas polillas. Investigaciones previas ya habían documentado que algunos esfíngidos responden a los murciélagos con ultrasonidos.

Sin embargo, persistían dos preguntas: cuántas veces había surgido esa respuesta y qué partes del cuerpo intervenían en cada caso. Resolverlas permite diferenciar un rasgo heredado de un único antepasado de una solución que surgió varias veces ante una amenaza similar.

Un estudio publicado en la revista Proceedings of the Royal Society B examinó esa historia evolutiva. Sus autores hallaron tres formas de producir señales defensivas y estimaron que la respuesta pudo aparecer entre cuatro y siete veces a lo largo de unos 30 millones de años.

Las polillas producen ultrasonidos mediante tres mecanismos de roce

Las polillas esfinge, también llamadas esfíngidos, incluyen unas 1.600 especies que en su mayoría tienen actividad nocturna.

Durante esas horas, los murciélagos buscan alimento mediante ecolocalización, un sistema que consiste en emitir sonidos y analizar los ecos que regresan desde los objetos cercanos.

Para evaluar la reacción de los insectos, el equipo encabezado por Paul K. Masonick, investigador de la Universidad de Florida, registró la respuesta de ejemplares expuestos a grabaciones de llamadas de caza de murciélagos.

También simuló el contacto de un depredador y documentó las emisiones de los insectos.

El estudio informó que, de las 143 especies evaluadas, 77 produjeron sonidos de alta frecuencia. Los investigadores concentraron el análisis en los machos porque la información disponible sobre esa capacidad en las hembras no permite aún una comparación amplia.

Las escamas modificadas se ubican en las válvulas genitales, piezas pares empleadas durante el apareamiento. El sonido surge cuando esas escamas rozan otras superficies.

Algunas especies las frotan contra una segunda fila de escamas situada cerca del extremo del cuerpo. Otras las arrastran sobre espinas rígidas de los bordes abdominales.

En un tercer grupo, las escamas se rozan contra pequeños nódulos, es decir, protuberancias presentes en la parte inferior del abdomen.

El hallazgo incorporó esa superficie al aparato que permite crear la señal acústica y mostró que una misma función defensiva puede depender de anatomías diferentes.

Cada forma de roce genera emisiones con rasgos distintos

Las diferencias en la superficie de roce se reflejan en las emisiones. Las especies que usan espinas o nódulos tienden a producir señales más continuas, mientras que aquellas que rozan escamas entre sí emiten ráfagas irregulares.

El estudio comparó duración, frecuencia y otros rasgos de esas respuestas. Los autores plantean que las señales más continuas tendrían mayor capacidad para interferir con la ecolocalización.

Las ráfagas irregulares podrían sobresaltar a un atacante o imitar las advertencias de insectos que resultan desagradables para comer. Esas funciones son hipótesis, ya que no se conoce con precisión cómo responde un murciélago a cada variedad de señal.

Marc Holderied, biólogo sensorial e investigador en bioacústica de la Universidad de Bristol, quien no participó del trabajo, señaló a Science News que el hallazgo muestra que estas polillas cuentan con un repertorio defensivo más amplio de lo que se conocía.

Nick Dowdy, biólogo evolutivo del Milwaukee Public Museum y ajeno al equipo investigador, destacó la variedad de emisiones asociadas a los nódulos.

Según explicó, esa diversidad podría dar a esas especies más opciones para adaptarse a sus depredadores, mientras que otros grupos estarían más limitados por su anatomía.

La presión de los murciélagos dejó huellas repetidas en la evolución

Los investigadores compararon las relaciones evolutivas de las especies para estimar cuándo surgió esta defensa.

El análisis sitúa sus posibles orígenes en un período que va de hace 5 millones a 30 millones de años y muestra que varias ramas desarrollaron mecanismos parecidos sin heredar un mismo sistema ya formado.

Este patrón se conoce como evolución convergente. Describe situaciones en las que distintos grupos llegan a una respuesta similar porque enfrentan presiones semejantes. En este caso, la caza nocturna de murciélagos parece haber favorecido una solución comparable por caminos anatómicos distintos.

La historia tampoco fue igual en todas las ramas. El análisis indica que varias especies que pasaron a una actividad crepuscular o diurna perdieron con el tiempo las estructuras vinculadas con la producción acústica. Ese cambio coincide con una menor exposición a los depredadores nocturnos.

polilla esfinge,murciélago insectívoro,ultrasonido,fauna nocturna