FBI investigating N. Korean IT staffer working for U.S. gov't agency: report

The U.S. Federal Bureau of Investigation (FBI) is currently probing how a North Korean remote information technology worker secured employment at a U.S. federal agency, according to a report released on Tuesday. This development highlights the escalating risks posed by Pyongyang's IT worker scheme targeting the U.S. government sector.

Todd Hemmen, deputy assistant director of the FBI's Cyber Capabilities Branch, disclosed this information at a forum last month. Hemmen was responding to a question regarding the impact of North Korea's IT worker scheme on the U.S. government. Despite finding the case perplexing, Hemmen confirmed that the FBI is indeed encountering remote IT workers not only in the private sector but also adversely affecting government agencies.

However, Hemmen refrained from providing further details, leaving the identity of the affected U.S. government agency and potential instances of sensitive information theft unclear. The report does not attribute any specific wrongdoing to any individual, organization, or nation.

The issue of North Korean IT workers has gained significant attention recently. Washington, Seoul, Tokyo, and other nations have intensified their efforts to thwart these schemes, which they suspect are utilized to generate revenue to finance North Korea's nuclear and other weapons of mass destruction programs. It is not uncommon for North Korean IT workers to obtain jobs using false identities and other fraudulent means, earning income remotely to bolster Pyongyang's weapons programs.

The latest case under investigation is not isolated. In the previous year, a Maryland resident was sentenced to 15 months in prison for facilitating a North Korean national in China to work on software development contracts for the Federal Aviation Administration. Additionally, late last month, an alert was jointly issued by South Korea, the U.S., Japan, and eight other countries, warning that North Korean IT workers pose an insider threat to companies and engage in activities such as data exfiltration, cryptocurrency theft, and the theft of sensitive information.