FBI Probes North Korean IT Worker Inside U.S. Federal Agency

The U.S. Federal Bureau of Investigation (FBI) is actively investigating how a North Korean remote information technology (IT) worker successfully obtained employment at a U.S. federal government agency, according to a report published Tuesday. The revelation underscores the growing risks posed by Pyongyang's state-sponsored IT worker infiltration scheme, which has now penetrated the U.S. government sector. · On August 10, 2026, Federal News Network first reported the FBI investigation. · On August 11, 2026, TechCrunch confirmed the FBI is investigating the case. · On August 12, 2026, Yonhap reported the FBI is probing the North Korean worker. · The FBI is investigating how a North Korean remote IT worker got a federal job. · The unidentified federal agency's hiring process is under scrutiny by the FBI. · It is unclear if any sensitive data was stolen during the intrusion. · The FBI declined to comment further on the ongoing investigation. · Hemmen called the case "baffling" due to the agency's unclear hiring process. · Experts say the incident highlights gaps in government vetting for IT roles. · The case marks a rare confirmed instance of a North Korean in a U.S. agency. Todd Hemmen, deputy assistant director of the FBI's Cyber Capabilities Branch, disclosed the investigation during a July 28 forum hosted by the Digital Government Institute in Washington. Hemmen stated that the FBI recently identified a North Korean remote IT staffer working for the federal government. He described the case as "a little bit baffling" and expressed confusion over the particular agency's hiring process. "The short answer is yes, we are seeing remote IT workers not just in the private sector... but we're also seeing this impact the government to a degree," Hemmen added. The FBI official did not elaborate on which agency was compromised or whether sensitive information was stolen. The incident is part of a broader scheme by North Korea to deploy IT workers globally using false identities and fraudulent methods to generate hard currency for the regime's nuclear and weapons of mass destruction programs. This is not an isolated case. Last year, a Maryland man was sentenced to 15 months in prison for allowing a North Korean national in China to work on software development contracts for the Federal Aviation Administration. Late last month, South Korea, the U.S., Japan, and eight other countries issued a joint alert about North Korean IT workers, warning they pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.