A Cleared Defense Contractor Lent His Identity to North Korea’s Remote Job Scheme. A Video Call That Did Not Match Helped Expose It
A 62-year-old Virginia man with a Top Secret clearance pleaded guilty to letting co-conspirators use his identity to apply for remote tech jobs, including government contractor work, and to hosting company laptops at his home. One employer spotted the mismatch on a video call.
John Allen Kurrle Jr. had what remote job fraudsters want most: a real American identity and an active Top Secret security clearance. On Wednesday, the 62-year-old from Gainesville, Virginia, pleaded guilty to conspiracy to commit wire fraud for letting others use both to chase remote tech jobs, part of the scheme U.S. authorities say North Korea uses to earn money and get inside companies.
This account is based on CyberScoop’s reporting on the guilty plea, with additional context from USA Today.
How the scheme worked
According to court records cited by CyberScoop, co-conspirators used Kurrle’s identity, and his clearance, in at least 88 job applications to U.S. companies, often government contractors. Those applications produced nine job offers with advertised salaries between $120,000 and $190,000 a year. Kurrle also admitted using a third person’s identity, without that person’s consent, for some of the applications.
When employers mailed out work laptops, they went to Kurrle’s home. He received and hosted machines from several victim companies so that people outside the United States could reach them remotely, the arrangement investigators often call a laptop farm.
Where it fell apart
The scheme looked bigger on paper than it was in practice. The longest job held under Kurrle’s name lasted about three weeks and paid $4,800 in total. Another employer, a company in Ventura, California, hired “Kurrle” as a software engineer on a generative AI project for part of the U.S. military. During a video call to verify his eligibility to work, the company noticed the person on screen did not match Kurrle’s age or appearance. It ended the employment before any work was done on the military contract, after paying almost $2,200 for 32 hours of onboarding, and Kurrle sent the laptop back.
Kurrle has been ordered to repay both amounts as restitution. He does not dispute that the scheme likely benefited North Korea but says he did not know about that connection while he was involved. He faces up to 20 years in prison, with sentencing scheduled for January 28, 2027. USA Today reported that his plea came on the same day the Treasury Department sanctioned ten people and one entity over similar schemes.
The bigger picture
Michael Barnhart, a nation-state investigator at security firm DTEX, told CyberScoop the case shows North Korea’s focus on contractor roles, which offer the path of least resistance toward strategically useful access. Prosecutors have charged or sentenced a growing number of U.S.-based facilitators who supplied identities or ran laptop farms, yet the scheme has reached an unknown number of businesses, including hundreds of Fortune 500 companies.
What this means for your company
You do not have to be a defense contractor to be a target; any business that hires remote technical staff is in scope. A few low-cost habits make the scheme much harder to pull off:
- Hold at least one live video interview with the camera on, and compare the person to their identity documents.
- Be wary when a new hire asks to ship equipment to an address other than the one on file, or to a third party.
- Watch new remote accounts for sign-ins from unexpected countries or through remote-access tools you did not approve.
- Give new staff only the access they need for their first weeks, and widen it as trust is earned.
- If you hold government contracts, make sure your hiring and onboarding checks match what your contracts require.
Want to tighten how your company verifies and onboards remote hires without slowing down good candidates? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
