Todd Hemmen, deputy assistant director of the FBI's Cyber Capabilities Branch, disclosed the case on July 28 at a Digital Government Institute conference in Washington, in response to a question about whether North Korea's remote IT worker campaign had reached government.

He said the bureau had identified the worker the week before but did not identify the agency or describe the worker's duties, according to Federal News Network, which reported his remarks on Aug. 11.

Hemmen said he was still working through the case and called it "a little bit baffling," telling the panel he did not understand the hiring process at the agency involved.

How the worker passed vetting and whether he reached sensitive systems or data have not been disclosed.

Federal investigators say North Korea has sent thousands of skilled IT workers around the world to obtain jobs fraudulently and generate revenue for its weapons programs, placing them inside hundreds of companies.

The United Nations estimates the operation earns Pyongyang between $250 million and $600 million a year.

The workers use fraudulent identities to win remote positions and funnel wages back to the regime while stealing intellectual property and other data, which they use to extort employers once discovered, TechCrunch reported.

The FBI seal at the entrance to the bureau's headquarters in Washington, D.C., in May 2025. Photo by Reuters

Experts told Federal News Network the public sector's involvement was not surprising, and said the case exposes gaps in government and industry vetting, particularly for IT support roles.

Three days after Hemmen spoke, the U.S. and 10 allies in Asia and Europe warned companies against hiring North Korean IT workers, saying in a July 31 joint statement that the labor funds Pyongyang's nuclear weapons and ballistic missile programs, AFP reported.

The signatories were Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the U.K., six of which had already issued their own advisories on the threat.

The alert said the workers pose as nationals of other countries to win contracts through commercial hiring and procurement platforms, then remit their salaries to their parent agencies in North Korea.

Their methods are growing more sophisticated, the statement said, including the use of AI to obscure their identities, and they represent an insider threat involved in data exfiltration and cryptocurrency theft.