An American defense contractor who held active Top Secret clearance with sensitive compartmented information (SCI) access pleaded guilty to conspiracy to commit wire fraud for his role in an illicit North Korean remote IT worker scheme, the United States Department of Justice confirmed last week.
Virginia resident John Allen Kurrle Jr., 62, acknowledged his role in trying to place the IT workers, whose wages were ultimately funneled back to North Korea. The scheme involved foreign individuals using his identity to apply for remote work positions, as well as fraudulently using the identity of a third person in a similar manner.
Kurrle pleaded guilty last Wednesday in the U.S. Attorney’s Office for the Eastern District.
“In addition to allowing the use of his identity to apply for remote work positions, Kurrle received laptops shipped by victim companies to his home in Gainesville and enabled remote access from outside the United States,” the DoJ explained.
In total, Kurrle’s identity, or the stolen identity, was used to obtain nine job offers from U.S. companies. The Justice Department did not identify the companies where the identities were used to gain employment.
Kurrle is currently scheduled to be sentenced on January 28, 2027, and he faces up to 20 years in prison.
Generating Cash for North Korea
Kurrle is just the latest individual to face jail time for aiding North Korea. Last December, Minh Phuong Ngoc Vong of Bowie, MD, conspired with others, including a foreign national living in Shenyang, China, to defraud U.S. companies; the others used his identity to obtain remote IT positions at more than a dozen American companies.
That scheme operated for several years; between 2021 and 2024, Vong was reportedly paid more than $970,000 in salary by 13 U.S. companies, several of which contracted his services to U.S. government agencies.
Christoper Burgess previously wrote for ClearanceJobs in May 2024 that an Arizona woman and three unidentified foreign nationals placed overseas information technology workers, posing as U.S. citizens and residents in remote positions within U.S. companies. Those four individuals “hoodwinked” more than 300 companies into hiring North Korean IT workers, who also used stolen or borrowed identities of Americans.
“North Korea has been working to get staff hired into sensitive positions for a while now. As companies have become more aware that they need to ensure that they’re not impacted, North Korea has adapted techniques so that they can continue,” explained Steven Swift, managing director at Suzu Labs.
Swift told ClearanceJobs that North Korea continues to try to identify people willing to provide their identity in exchange for compensation.
“It appears that this is easier for them than simply performing identity theft and otherwise performing similar actions,” he warned.
Easier Than It Sounds
Companies and individuals should remain vigilant, especially in the AI era, where deepfake videos and AI voice generators can make it easy to spoof someone’s credentials.
“For remote interviews, a lot of deepfakes struggle with dynamic content, but are perfectly capable of having a candidate sit still and talk. Having the candidate move around, put their hands in front of their face, or move around the room on camera, etc.,” suggested Swift. “Anything to increase the difficulty of successfully faking a persona. Onsite final-round interviews also work great. Even for remote positions, if you really want to be sure that someone is who they say they are, fly them to you.”
An even more direct approach is to ask candidates to say something negative about North Korea and/or its leaders. That may seem odd, but it is both simple and effective, in part because the populace is essentially conditioned not to be critical of the regime.
“There have been reports of candidates simply hanging up on the interview when asked to make such statements. It obviously only defends from North Korea specifically, although they are the region most well known for this type of employment attack,” added Swift. “Additionally, make sure that your background check process looks for signs of multiple full-time jobs being held at the same time. It’s reported that North Korea was re-using the same identities multiple times. This won’t catch a fresh identity being used for the ‘first time,’ but even if it only helps sometimes, it’s worth including.”
Be Prepared
Although this may not seem like a traditional “cybersecurity” threat, enterprises still need to be mindful of it and recognize it.
“Every organization needs to look seriously at its security support structure. Look at this type of attack. Look at Edward Snowden,” said John Strand, owner of cybersecurity provider Finite State. “Then ask one simple question. Can you detect a malicious insider?”
Strand told ClearanceJobs that question needs to be taken seriously, as it could indicate that the security support structure is flawed.
“You could have a malicious insider, or you could have an attacker using a legitimate user’s account like a puppet. Distinguishing between the two can be next to impossible. Either way, you need to be able to detect what that account is doing,” cautioned Strand.
In the short term, North Korea’s goal may be about raising capital for the regime, but that may be the “short con” to what is actually a “long game” that goes far beyond tomorrow’s payday.
“North Korea seems primarily interested in positions with access to information or systems. Their primary motivation seems to be access, much more than simply getting a few insiders good foreign jobs,” explained Swift. “If this describes the type of work you’re hiring for, ensure that you’re taking this risk seriously.”
