A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 

John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.

The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.

The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.

His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.

Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company. 

The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company. 

Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.

Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated. 

The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.

Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.

Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives. 

Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.

The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.

Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman. 

Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.

The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.

Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. 

The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad.

An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. It alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay. 

An Ohio resident, Trey Michael Nolte, is also named as a co-conspirator in the indictment, but is not charged. Two unnamed defendants were also charged.

“This investigation is about far more than fraud,” Ryan Raybould, a U.S. attorney in the Northern District of Texas, said in a release. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

This particular scheme proliferated over the past decade as remote work became more common. There have been multiple indictments since 2024 that have looked to charge willing conspirators in the U.S., while also disrupting the ability for North Korean nationals to successfully earn a paycheck. 

Despite those actions, the scheme has persisted. Last month, U.S. and allied governments warned that a North Korean hacking group operating under the country’s Munitions Industry Department’s 313 General Bureau is infiltrating tens of thousands of job seekers’ networks by posing as prospective employers like AI firms to steal sensitive data and millions in cryptocurrency. The intent is to circumvent economic sanctions that prevent the country from bankrolling its military ambitions through legitimate financial channels.

Detailed in an indictment released Tuesday, this particular scheme was allegedly facilitated by Nolte, who kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. The DOJ said Bostelle aided the scheme by providing his name and a fraudulent driver’s license to help a remote worker obtain a job, Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers.

Prosecutors also allege that the men filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity theft victims.

The FBI also released an updated advisory that detailed how the scheme has changed over the past few years. Under pressure from better detection, North Korean workers now pay U.S. citizens to appear in interviews, take drug tests, access accounts, and keep company laptops running at home. They target people under financial strain, whom they see as easier to recruit. 

Some go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job. 

The advisory also recounted sharper tactics: threats against former managers after firings, demands for payment backed by stolen data, and paid helpers sent to intimidate companies in person. 

The group has also changed how they use certain tools. CrowdStrike, which provided assistance to law enforcement, reported that since May, the group has spoofed device identifiers, making a video capture card appear as a webcam, and reused the same disguised device across several jobs. Because these habits resemble normal remote work, no single warning sign catches them, the FBI said, so it called for layered checks throughout employment and warned that blunt filters would screen out qualified applicants.

Adam Meyers, CrowdStrike’s head of counter adversary operations, told CyberScoop while the tradecraft may change, the North Koreans’ goal of evading sanctions remains the same.

“As companies get better at identifying fraudulent workers and law enforcement disrupts their infrastructure, FAMOUS CHOLLIMA is finding new ways to conceal its operations and make the scheme more resilient,” Meyers said. “That’s why disruption is so important. Working with the FBI, we’re not just identifying the threat but dismantling the infrastructure that enables it, forcing the adversary to rebuild and reinvest. Every laptop seized, every facilitator exposed, and every operation disrupted raises the cost of doing business for North Korea.”

Despite the law enforcement effort, CrowdStrike said in its own announcement that this particular action is unlikely to have a lasting effect.

“While disrupting a laptop farm will likely only yield a limited impact on Famous Chollina centered mostly on the geolocation of the takedown, these operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements,” the blog post reads. 

The State Department is offering rewards of up to $5 million for further information that disrupts this scheme. 

You can read the full indictment below. 

UPDATE, 10/14/2026, 11:25 a.m.: This story has been updated with comment from CrowdStrike’s Adam Meyers.

The post DOJ charges 14 over a sprawling North Korean remote work scheme appeared first on CyberScoop.

North Korean hackers are infiltrating tens of thousands of job seekers’ computer networks by posing as prospective employers, such as artificial intelligence firms, to steal sensitive information and millions of dollars worth of cryptocurrency, U.S. and allied governments warned Friday.

The security agencies behind the alert, attributed the group, known as WaterPlum or Contagious Interview, as operating under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea. The efforts dovetail with those of North Korean IT workers.

“WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities,” the agencies wrote. “They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services.”

Additionally, “Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients,” read the alert from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense’s Cyber Crime Center.

They’ve used the stolen information to fuel other operations, and the overlap between WaterPlum and North Korean IT workers is substantial, the agencies said.

“WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at the Japanese cryptocurrency exchange,” they wrote.

Collectively, WaterPlum has infected more than 30,000 devices in more than 100 countries, targeting IT professionals in Japan, the United States, Europe and other nations. Its operations have transferred the equivalent of nearly $11 million of cryptocurrency from over 7,000 crypto wallets to North Korea, according to the alert.

The law enforcement agencies said they have had some success tackling the group, but are seeking further cooperation and released details in the alert about WaterPlum’s tactics, techniques and procedures.

“For the first time in Japan, authorities successfully identified, investigated, and dismantled a ‘laptop farm’ operated by an enabler in Japan,” the alert reads. “Japanese authorities obtained evidence this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan. The FBI continues to identify and prosecute US-based actors providing illicit facilitation services to North Korean IT workers.”

The warning comes as the Multilateral Sanctions Monitoring Team, an international panel overseeing UN sanctions against North Korea, released a report exposing thousands of North Korean nationals employed in industries around the world.

The post International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data appeared first on CyberScoop.

The people orchestrating North Korea’s IT worker scheme are funneling money through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report Tuesday.

The security firm’s research shows that the scheme is moving beyond funding the country’s weapons program and into a bigger pool that supports many of the regime’s objectives. This includes manufacturing weapons and supplying them to Russia’s military, according to DTEX.

“When we think IT workers, we typically think head down, get your money, support the weapons program,” Michael Barnhart, nation state investigator at DTEX and lead author of the report, told CyberScoop.

“It’s a broad cover-all statement when we say it’s supplying the weapons program,” he said. “That’s the predominant place it goes,” but many other domestic programs and entities tasked with other projects are taking cuts from that pool of money as well. 

Barnhart corroborated previously leaked data from an internal North Korean payment server, which included 390 IT worker accounts, chat logs and transaction data.

He mapped the transactions to organizations that received those funds, including multiple sanctioned entities: Sobaeksu, Saenal, and Songkwang. 

The money trail also showed $1.97 million in payments from North Korean IT workers between December 2025 and February 2026 flowing directly through Korea Ryonbong General Corp, a sanctioned defense entity that procures weapons for the regime’s military programs.

Western officials previously reported that North Korea provided ammunition and weapons to Russia in 2023, and in the fall of 2024 sent upwards of 15,000 soldiers to fight alongside Russian troops, according to the Council on Foreign Relations.

“This is a consequence that is often overlooked,” Barnhart wrote in the report. “Revenue from the IT worker stream does not stop at a resume scam or a payroll-abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support.” 

Data from the internal North Korean payment server, which was first published by ZachXBT in April, is controlled by “PC-1234,” a single administrator that DTEX has been tracking for a while. The wallet and its cluster of activity remains active, Barnhart said. 

The three months of previous activity attributed to the wallet amounted to more than $2.84 million, which then flowed upward into dozens of organizations. 

“It’s not a top-down funded regime. It’s a bottom-up,” Barnhart said. “Everyone makes money at the bottom and then they take a tiny cut, and then the money goes upwards to what we just blanketly say is the weapons program. But really, it can go a lot more places.”

The post North Korea’s IT worker scheme funds Russia’s war effort appeared first on CyberScoop.