Defense contractor Kurrle pleads guilty to lending identity and hosting laptops for North Korean remote worker scheme
John Allen Kurrle Jr., a 62-year-old defense contractor with a top secret clearance, pleaded guilty to conspiracy to commit wire fraud for aiding North Korea's remote IT worker scheme, the Justice Department said. He let co-conspirators use his identity and clearance for at least 88 job applications at U.S. companies, often government contractors, which produced nine job offers between June and October 2025. The scheme had limited success: the longest engagement lasted about three weeks and paid $4,800. One victim company, hiring for a generative AI project for a U.S. military component, caught the mismatch during a video verification call and terminated the worker before any military work was done. Kurrle faces up to 20 years in prison, with sentencing scheduled for Jan. 28, 2027.
Detalhes técnicos
- Kurrle received and hosted laptops shipped by multiple victim companies at his residence in Gainesville, Virginia, enabling co-conspirators to access them remotely from outside the United States (a laptop farm arrangement).
- His identity was used to obtain a software engineer role at a Ventura, California-based company. The company detected that the person on the verification video call did not match Kurrle's age or physical characteristics.
- Kurrle also admitted using a third person's identity without consent to apply for remote positions. He does not dispute that the scheme likely benefitted North Korea but claims he was unaware of the North Korean link.
- DTEX researcher Michael Barnhart said Kurrle had previously been identified as a facilitator, though it was unclear until recently whether he was a victim or had been impersonated. DTEX assesses North Korea targets contractor roles as the path of least resistance to strategic intelligence.
- DTEX reported in July that proceeds also flow through front companies and sanctioned intermediaries that partly fund Russia's war effort against Ukraine.
Remediação
- Kurrle must pay restitution of about $2,200 (onboarding pay) plus $4,800 from the other company.
- Defenders should keep rigorous identity verification during hiring, including live video checks, which exposed the impersonation here, and scrutinize laptop shipments to residential addresses.
Linha do tempo
-
Defense contractor Kurrle pleads guilty to lending identity and hosting laptops for North Korean remote worker scheme
ler a análise desta fonte ocultar
John Allen Kurrle Jr., a 62-year-old defense contractor with a top secret clearance, pleaded guilty to conspiracy to commit wire fraud for aiding North Korea's remote IT worker scheme, the Justice Department said. He let co-conspirators use his identity and clearance for at least 88 job applications at U.S. companies, often government contractors, which produced nine job offers between June and October 2025. The scheme had limited success: the longest engagement lasted about three weeks and paid $4,800. One victim company, hiring for a generative AI project for a U.S. military component, caught the mismatch during a video verification call and terminated the worker before any military work was done. Kurrle faces up to 20 years in prison, with sentencing scheduled for Jan. 28, 2027.
Technical Details
- Kurrle received and hosted laptops shipped by multiple victim companies at his residence in Gainesville, Virginia, enabling co-conspirators to access them remotely from outside the United States (a laptop farm arrangement).
- His identity was used to obtain a software engineer role at a Ventura, California-based company. The company detected that the person on the verification video call did not match Kurrle's age or physical characteristics.
- Kurrle also admitted using a third person's identity without consent to apply for remote positions. He does not dispute that the scheme likely benefitted North Korea but claims he was unaware of the North Korean link.
- DTEX researcher Michael Barnhart said Kurrle had previously been identified as a facilitator, though it was unclear until recently whether he was a victim or had been impersonated. DTEX assesses North Korea targets contractor roles as the path of least resistance to strategic intelligence.
- DTEX reported in July that proceeds also flow through front companies and sanctioned intermediaries that partly fund Russia's war effort against Ukraine.
Remediation
- Kurrle must pay restitution of about $2,200 (onboarding pay) plus $4,800 from the other company.
- Defenders should keep rigorous identity verification during hiring, including live video checks, which exposed the impersonation here, and scrutinize laptop shipments to residential addresses.