FBI Warns of North Korean IT Workers Exploiting U.S. Companies for Cybercrime and Extortion

The FBI has issued a critical alert about North Korean IT operatives embedding themselves in U.S. businesses under false identities, stealing sensitive data, extorting companies, and funneling illicit earnings to the regime. While these state-backed actors have long engaged in cybercrime, recent activity has escalated from unauthorized access to full-scale extortion and sabotage.

Disguised as remote freelancers or contract developers, North Korean IT workers gain employment under false identities, bypassing standard hiring checks. Once inside, they systematically exfiltrate proprietary code, steal credentials, and exploit corporate networks to generate illicit revenue. In other words, these IT operatives don’t rely on brute-force cyberattacks but embed themselves within organizations, acting as insiders rather than external hackers.

A press release published on January 25, 2025, by the FBI outlined the subsequent recurrent tactics:

• Intellectual property theft at scale – entire code repositories cloned to personal cloud accounts.
• Credential harvesting – stolen login data allows prolonged, undetected access.
• Data extortion – if discovered, operatives demand ransom in exchange for not leaking critical company information.
• Infrastructure abuse – compromised networks are exploited for cybercriminal activity that generates revenue for North Korea.

For years, North Korea has weaponized cybercrime as a strategic tool, using bank heists, crypto theft, and IT fraud to fund its weapons programs. Unlike traditional hacking, this operation blends seamlessly into global IT labor markets, leveraging deepfake technology, AI-assisted identity fraud, and VPN obfuscation to evade detection.

In December 2024, fourteen North Korean nationals were indicted for allegedly orchestrating a scheme in which IT workers, using fraudulent identities, secured jobs at U.S. companies and redirected their earnings to Pyongyang to finance ballistic missile development and other weapons programs. Ashley T. Johnson, head of the FBI’s St. Louis office, revealed that the scheme involved thousands of North Korean IT workers and had funneled over $88 million (€84 million) to Pyongyang, directly supporting the regime’s operations.

This methodical deception presents a dual threat: economic damage through stolen intellectual property weakens U.S. businesses and erodes competitive advantage and national security risk via access to critical data. IT infrastructure increases vulnerabilities in sectors from finance to defense. Without stringent hiring and security controls, companies risk unknowingly funding a hostile regime while exposing themselves to severe breaches.

North Korea’s approach mirrors to a certain extent the cyber playbooks of Russia and China, where sustained insider threats, supply chain compromises, and state-sponsored hacking fuel economic and political influence. However, its raw financial motivation makes North Korea’s model distinct.

China steals intellectual property for global dominance. It infiltrates high-tech industries, AI firms, and semiconductor companies to fast-track its industrial and military capabilities. Beijing’s approach is systematic—long-term data harvesting rather than smash-and-grab theft. Conversely, Russia hacks to disrupt and destabilize. From election interference to hijacking infrastructure, Russian cyber warfare is a mix of espionage, psychological operations, and economic coercion rather than direct monetary gain.

Yet, North Korea monetizes cybercrime as a core pillar of its economy. Unlike China and Russia, Pyongyang operates under crippling sanctions and has built an entire industry around illicit digital operations. Cyber-enabled fraud is a state-run business model that ranges from hacking banks to laundering cryptocurrency.