North Korean operatives infiltrate US companies and government using stolen identities and AI

Aug 12, 2026

North Korean operatives are systematically infiltrating U.S. companies and federal agencies to secure remote IT jobs. Utilizing stolen American identities, AI tools like ChatGPT, and Google Gemini-processed documents, these workers bypass traditional vetting processes. The FBI is currently investigating a rare breach of an unnamed federal agency. This highly coordinated campaign funnels up to 90% of worker salaries back to Pyongyang, generating up to $800 million annually to fund Kim Jong Un's sanctioned nuclear weapons program.

North Korean IT worker infiltration

▪The Federal Bureau of Investigation states that thousands of North Korean IT workers are applying for remote jobs across the United States.
▪North Korean operatives have built a secret workforce inside American companies by using stolen identities, artificial intelligence tools, and fake profiles to secure remote jobs.

Stolen identity fraud tactics

▪In April 2026, the U.S. Justice Department sentenced two U.S. facilitators for a scheme that placed North Korean workers at more than 100 U.S. companies using at least 80 stolen identities.
▪North Korean IT workers use stolen American identities to pass candidate evaluations, often holding down multiple remote jobs under a single stolen name.

AI-generated document forgery

▪North Korean operatives used Google Gemini to process fake identification documents, which left a SynthID watermark embedded in the images.
▪An investigation showed that a North Korean cell applied for remote jobs at more than 1,000 companies in three months, using ChatGPT to write cover letters and answer hiring questions.

Ballena Azul honeypot investigation

▪Security researchers Mauro Eldritch, Heiner García, and ANY.RUN created a fake decentralized finance protocol called Ballena Azul to attract and hire three suspected North Korean IT workers.
▪The three suspected North Korean operatives hired by Ballena Azul used browser extensions like AIApply, Final Round AI, and Simplify Copilot to assist with their job applications and interviews.

US government agency breach

▪In 2024, the U.S. Justice Department brought charges against a Maryland man who assisted a North Korean hacker in posing as an American to secure a remote contractor job at the Federal Aviation Administration.
▪The Federal Bureau of Investigation is investigating how a North Korean remote IT worker was hired to work for an unnamed U.S. federal government agency.

Revenue funneled to regime

▪The U.S. Treasury Department discovered that up to 90% of the salaries earned by North Korean IT workers flow back to the regime, generating up to $800 million annually.
▪The Kim Jong Un regime relies on cybercrime, including cryptocurrency thefts that netted at least $2 billion in 2025, to fund its globally sanctioned nuclear weapons program.