Contractor Identity Used in North Korea Job Scam

A U.S. defense contractor admitted that co-conspirators used his identity and security clearance to apply for remote jobs at U.S. companies, including work tied to a military AI project. The case shows how fraudulent remote-job applicants can use a trusted U.S. identity, receive company equipment at a local address, and try to access sensitive work from overseas.

Key findings

• Co-conspirators used John Allen Kurrle Jr.'s identity and government clearance in at least 88 applications to U.S.-based companies.
• The operation received nine job offers, including a software-engineering role on a generative-AI project for a U.S. military component.
• Victim companies shipped laptops to Kurrle's Virginia residence, where they could be accessed remotely by co-conspirators outside the United States.
• A company stopped one placement after a video employment-verification call showed that the person on screen did not match Kurrle's age or physical characteristics.
• The case reflects North Korean efforts to use fraudulent remote workers to obtain income and pursue access to strategically valuable contractor roles.

Who’s being targeted

• Commonly targeted roles: Recruiters, Human resources, Hiring managers, IT onboarding teams, Security teams, Government contractor program managers, Remote-work managers.
• Affected industries: Defense contracting, Government contracting, Technology and software development, Artificial intelligence, U.S. military support.
• Attack channels: website.
• Impersonated: A legitimate U.S. defense contractor employee with a government security clearance.

Awareness takeaways

• Require live identity verification for remote hires, especially for sensitive roles, and escalate discrepancies between the applicant and the verified identity.
• Independently validate claimed security clearances, work history, and identity before granting a remote worker access to sensitive projects.
• Treat company devices shipped to employee residences as a potential control point; confirm who possesses and uses the equipment before granting access.

Red flags to watch for

• The person on a live video verification call does not match the applicant's stated age or physical characteristics.
• A sensitive remote role relies on identity or clearance claims that cannot be independently verified.
• Equipment is shipped to a U.S. address but may be remotely accessed from outside the country.