The Defense Cyber Crime Center is seeing a record number of companies reporting insider threats.
The FBI warned last week about North Korean schemes to fund its regime through remote IT work for U.S. companies.
These are just two recent examples of the growing threats contractors and federal employees are facing from foreign countries.
“Foreign intelligence entities are persistent in their efforts to steal critical American technology, compromise sensitive data, and undermine our nation’s defense capabilities. Using tactics from cyberattacks to supply chain disruption, their objective is not only to exploit vulnerabilities, but also to pilfer technology and talent to advance their own military and economic development at the expense of ours,” wrote the Defense Counterintelligence and Security Agency in its annual report on threats targeting the cleared industry. “The cleared national industrial base — which includes academia, corporations of all sizes, and the personnel who research, develop and field our nation’s technologies — is a primary target for these foreign threats. As the cleared national industrial base continues to produce innovative capabilities, it becomes an even more attractive target for our adversaries.”
Les Bernys, the executive director of the Department of Defense Cyber Crime Center, said the number of insider cyber incidents reported over the last six months far outpaced any other time in DC3 history.
DC3 says more broadly, critical incident reports, which include insider threats, from defense companies have increased by over 50% in the last fiscal year. DC3 says it can’t give complete figures due to the anonymity of the DIB companies reporting.
Bernys said DC3 is seeing two kinds of insider threats.
“One type are former DoD employees who did malicious things to the network before they left or still have access to data after they left and were trying to exfiltrate data and, possibly, doing nefarious things with that data,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. “The second type of incident are companies are reporting that they have hired individuals who they thought were Americans but were North Korean. These incidents aren’t coming in huge numbers, but the increase is noticeable.”
He added companies are struggling to better verify their applicants.
70 companies impacted by scheme
The DC3 update comes on the heels of the FBI’s recent warning about North Korea trying to place IT workers in companies.
The Justice Department reported last week an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by North Korean IT workers.
Justice says in total, the scheme, which started in 2019 and went through 2025, impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers.
Justice says the revenue is believed to have been sent to organizations controlled by North Korea. Companies in the healthcare, communications, cyber support, retail, and manufacturing sectors across Ohio, 16 additional states and the District of Columbia all fell victim to this scheme.
At the same time, the FBI published a public service announcement describing the evolving North Korean IT worker threat, including tips on how to detect the threat.
The bureau says to identify applicants in job pipelines or on corporate networks companies need to examine multiple compounding behaviors. The FBI says these behaviors may seem innocuous individually, but when considered together they are highly suggestive of malicious activity.
These include:
- Using remote desktop software to connect to employment-related devices.
- Frequently downloading applications outside of, or unconnected to their job role on work devices.
The FBI also said increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals.
The FBI also says these groups are attempting to use identities or facilitators with the qualifications to obtain a larger pool of jobs, including positions requiring U.S. government security clearances or unique technical skills. The bad actors also are targeting positions with cleared defense contractors and other companies involved in U.S. government contracts as well as active-duty U.S. military members to host laptops.
Suspicious contacts declined last year
Employees with clearances are a growing target for foreign actors, DSCA says.
In its annual report for fiscal 2025, companies reported more than 22,000 suspicious contacts. Of those, DCSA identified roughly 2,900 incidents that involved foreign entities seeking sensitive information or technology from cleared industry. In some incidents, foreign entities attempted to circumvent sanctions and compromise cleared employees.
DCSA says suspicious contacts are defined as if there is roughly an even chance or higher likelihood these suspicious contacts represent attempts—by individuals of all nationalities—to illegally access cleared facilities, classified information, classified technology or to compromise cleared employees. The SCRs submitted to DCSA also included foreign attempts to acquire dual-use, sensitive, or other U.S. technologies and information.
DCSA says in 2024, companies reported approximately 32,000 SCRs, and in 2023 these firms reported 28,000 SCRs, which also was more than a 7 percent increase from 2022.
The agency says for 2025, more than 48% of these targeted attempts came from the east Asia and Pacific regions, and the bad actors’ most often used tactics were exploitation of experts and resume submission.
“Foreign entities frequently sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge and expertise,” the agency stated. “Exploitation of cyber operations also remained a significant methods of operation across multiple regions, with actors targeting public-facing websites, contractor networks, and points of trust within organizational ecosystems.”
In trying to obtain access, DCSA said bad actors used resumes in attempts to access emerging technology roles in U.S. academia and cleared industry, seeking legitimate placement and proximity to defense research data, tools and professional networks.
While the DC3, the FBI and DCSA data show there is a growing number of insider threats out there, agencies and contractors can take steps to protect themselves from these risks. The Cybersecurity and Infrastructure Security Agency (CISA) updated its Insider Threat Mitigation Guide last month to try to draw more attention to how agencies and companies can combat this ongoing problem.
Insider threats cost in money, time
CISA says this updated guide gives employees an understanding of behavioral indicators that may signal a risk.
“Insider threats can be either intentional or unintentional. A significant portion of insider threats involve negligent or accidental behaviors,” CISA wrote. “Each insider threat will have or have had some level of a trusted relationship with their victim and act in a way that is outside the expectations of that trusted relationship.”
Additionally, CISA determined the cost of insider threats to organizations. It says it costs each company about $4.8 million a year for credential theft and it takes on average 81 days to contain an insider threat incident.
CISA also updated the guide to include several case studies around what a successful threat management strategy looks like or how a trusted employee can become an insider threat.
It also offers expanded insights on emerging workplace trends such as increased hybrid and remote work, how artificial intelligence can be used to manipulate or deceive, and new content on access control, visitor screening and mitigating the risk of adverse employee separations.
“The issue of insider threat management is much more nuanced and prevalent than the highly publicized, but rare, instances of disturbed employees engaging in violent activities. Very few organizations will ever experience episodes of that kind; a far greater number will face other forms of insider threat, such as sabotage, theft of intellectual property and cyberattacks,” CISA wrote. “Users of this Guide should remember there is no ‘one-size-fits-all’ approach to threat management. Intervention strategies may not always apply strictly to the individual, nor will each strategy work as intended. Effective approaches implement multiple, complementary solutions that affect the individual, the potential victim and the organizational environment. They should be holistic, respectful and prevention-focused, and they should use case-specific solutions. Intervention strategies should be a careful balance between protecting the organization and caring for the individual.”
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.