Fox News senior national correspondent Rich Edson reports on North Korean IT workers fraudulently obtaining remote jobs at major U.S. companies to funnel money back to Pyongyang.<\/p>\n
Thousands of North Korean operatives posing as IT workers are applying for remote jobs at U.S. companies, and many are getting hired.\u00a0<\/p>\n
Using stolen American identities, U.S.-based "laptop farms" and artificial intelligence to write r\u00e9sum\u00e9s and help answer interview questions, Kim Jong Un\u2019s regime is exploiting the remote work economy to get its workers inside American companies.<\/p>\n
In 2024 alone, the sprawling, state-directed workforce generated nearly $800 million for North Korea,\u00a0according to the Treasury Department, helping the heavily sanctioned regime fund its weapons programs.<\/p>\n
"The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said in a statement.<\/p>\n
A North Korean flag flutters next to concertina wire. (Edgar Su\/Reuters)<\/p>\n
Once hired, the workers gain legitimate credentials and trusted access to corporate networks, potentially opening the door to theft, espionage, extortion and more sophisticated North Korean cyber operations.<\/p>\n
Fox News interviewed Michael "Barni" Barnhart, a former Army intelligence specialist turned cybersecurity threat hunter who\u00a0tracks North Korean IT workers for a living.\u00a0<\/p>\n
Barnhart said the workers are so pervasive that when he recently sampled 20 Fortune 500 companies, he found evidence that North Korean IT workers had applied to, worked for or targeted 18 of them.<\/p>\n
Barnhart has spent much of his career hunting America\u2019s adversaries.\u00a0<\/p>\n
He joined the Army as a teenager, training in human intelligence before moving into signals intelligence and counterterrorism and deploying to Iraq.\u00a0<\/p>\n
He later moved into cybersecurity, eventually helping build Mandiant\u2019s North Korea-focused threat hunting operation before the company was acquired by Google. Now at cybersecurity firm DTEX, Barnhart focuses on nation-state insider threats, including the sprawling North Korean IT worker operation.<\/p>\n
Michael "Barni" Barnhart during his service in the U.S. Army. (Courtesy of Michael Barnhart)<\/p>\n
His pursuit of North Korean hackers has even left a permanent mark.\u00a0<\/p>\n
Barnhart has tattoos on his feet commemorating North Korean hacking groups he has helped investigate, including APT43 and APT45, groups tied to operations targeting U.S. think tanks and healthcare organizations.\u00a0<\/p>\n