When I helped catch Robert Hanssen, one of the FBI’s most damaging spies, we were hunting a man who had already earned the government’s trust. He possessed the credentials, security clearances, and access necessary to betray his country. Our challenge was proving that a trusted insider was secretly working for the enemy.

Today, our adversaries have turned that problem upside down. They manufacture trusted insiders from the beginning, using stolen identities, convincing résumés, and increasingly sophisticated technology to infiltrate organizations that may never meet their new employees in person.

I’ve written twice about North Korea’s extraordinary campaign to place fake employees inside American companies. This week, the Justice Department announced a major new crackdown, and the scale of the operation should concern every business leader in America.

Meanwhile, hackers in France have discovered that refrigerators make surprisingly effective cyberattack targets. And in our Tip of the Week, I’ll show you how to protect your smartphone from a thief who may be more interested in your digital identity than the phone itself.

Let’s get into it.

Somewhere in Texas, inside an otherwise ordinary American home, a collection of laptop computers sits humming away. Each machine belongs to a different American company. Each has been issued to an employee who supposedly lives and works in the United States.

But the people operating those computers are thousands of miles away.

The laptops are connected to remote-access equipment, allowing overseas workers to operate them while appearing to be sitting at their desks in America. To the companies that hired them, these employees are legitimate software developers, engineers, and technology specialists. They attend meetings, complete assignments, collect paychecks, and enjoy access to corporate systems.

There’s just one problem.

They’re working for North Korea.

I’ve been following this extraordinary espionage and fraud operation for months. In April, I told you about ⁠a suspicious job applicant whose interview helped expose a North Korean laptop farm. In May, I examined ⁠the growing army of imposters infiltrating American companies.

Now, the FBI has delivered another major blow to the operation.

On October 13, the Justice Department announced coordinated law enforcement actions against an alleged North Korean remote-worker network that infiltrated more than 70 American companies and generated approximately $3 million in revenue.

A federal grand jury indicted 14 defendants, including American facilitators and individuals based in China. Two Americans were arrested. During an operation appropriately named Operation Lonestar Roundup, FBI agents searched more than 40 residences across Texas and seized approximately 187 laptops and related devices used to facilitate the scheme.

The operation is one of the latest chapters in a sprawling campaign that has transformed remote employment into a source of revenue for Kim Jong Un’s regime.

The scheme is remarkably effective because it exploits something companies desperately need: skilled employees.

North Korean operatives use stolen or fabricated identities to apply for remote technology positions at American businesses. They construct convincing résumés, establish online professional profiles, and interview for jobs using identities that conceal their true locations.

Once hired, the company ships a laptop to what it believes is the employee’s American address.

That’s where the facilitators come in.

According to federal prosecutors, American accomplices received employer-issued computers, configured remote-access software, and maintained networks of devices that allowed overseas workers to appear as though they were operating from inside the United States. The workers could then perform their jobs, access corporate systems, and collect salaries without revealing their identities or actual locations.

The latest indictment alleges that the operation ran from 2019 through approximately July 2025, targeting companies in healthcare, communications, cybersecurity support, retail, and manufacturing.

The Justice Department believes the proceeds were transferred to sanctioned entities controlled by North Korea.

That money matters. The regime faces extensive international sanctions designed to constrain its nuclear weapons and ballistic missile programs. Fraudulent employment provides another way to generate revenue while circumventing those restrictions.

And the danger extends well beyond the money.

Traditional cybersecurity assumes an attacker is trying to break through the perimeter. Firewalls, endpoint protection, and intrusion detection systems are designed to identify unauthorized activity and keep outsiders from gaining access.

But what happens when the attacker is an authorized employee?

The company has already issued the credentials. The laptop is legitimate. The employee has been granted permission to access internal systems. From the network’s perspective, everything may appear normal.

This is the modern insider threat, and it presents a particularly difficult challenge because the deception begins before the employee’s first day.

The FBI’s latest warning suggests that North Korean operators are adapting as companies become better at identifying suspicious applicants. American facilitators are taking on increasingly sophisticated responsibilities, and some operations are subcontracting entire jobs to additional foreign workers.

The result is a distributed criminal enterprise that can survive the exposure of individual operatives.

When we caught Hanssen, the challenge was identifying the traitor inside an organization that already trusted him. Today’s North Korean operation creates that trust through deception, then exploits it.

The lesson for American businesses is straightforward. Identity verification cannot end when someone accepts a job offer. Employers must independently verify who they are hiring, investigate suspicious remote-access activity, and ensure that corporate devices are actually being used by the people authorized to operate them.

The next hostile insider may arrive with an impressive résumé, glowing references, and a perfectly ordinary request to have a company laptop shipped to his home.

And somewhere on the other side of the world, someone may already be waiting to log in.

When employees arrived at an Intermarché supermarket in Normandy, France, last Monday morning, they discovered something extraordinary. The store’s refrigeration systems were running, but instead of keeping food cold, they were heating it.

One freezer registered 122 degrees Fahrenheit. In the fish section, temperatures reportedly climbed as high as 176 degrees.

The culprit wasn’t a mechanical malfunction. It was a cyberattack.

Hackers had compromised connected refrigeration controls, reportedly manipulating defrost settings and turning equipment designed to preserve food into machines that destroyed it.

The attack affected approximately 700 supermarkets across France, including stores operated by Intermarché, Netto, Carrefour, Monoprix, and Cooperative U.

At the Normandy supermarket, director Julien Fréret described the heartbreaking task of throwing away approximately $112,000 worth of spoiled food. Across the country, businesses scrambled to disconnect refrigeration equipment, repair systems, and prevent further losses.

French authorities launched an investigation into the attack, which exposed vulnerabilities in internet-connected refrigeration controllers. Some affected equipment relied on outdated technology that no longer received security updates.

Consider the implications. Hackers didn’t need to steal customer information or deploy ransomware to inflict substantial damage. They simply manipulated the systems controlling the temperature of food.

The same underlying problem exists in hospitals, manufacturing facilities, water treatment plants, and countless other environments where computers control physical equipment.

As more of our infrastructure becomes connected, cybercriminals are discovering new ways to cause real-world destruction.

In France, they found a way to turn the frozen-food aisle into a disaster zone.

You’re standing on a sidewalk, checking directions on your phone, when someone races past on a scooter. In one practiced movement, the thief snatches the phone from your hands and disappears into traffic before you can even cry out.

Within seconds, the thief may try to activate Airplane Mode, disconnecting your phone from cellular networks and making it harder to track.

Here’s how to make your phone harder to steal and exploit.

iPhone: Open Settings → Face ID & Passcode → Allow Access When Locked and turn Control Center OFF. This prevents thieves from opening Control Center and activating Airplane Mode while your phone is locked. Next, enable Stolen Device Protection in the same settings menu and select Always for the security delay.

Android: Open Settings → Google → All services → Theft protection. Enable Theft Detection Lock, Offline Device Lock, and Identity Check, where supported. On compatible Samsung devices, also enable Lock network and securityin Secure Lock Settings to restrict network changes while locked.

Finally, make sure Apple’s Find My or Android’s Find Hub is enabled before your phone goes missing.

These protections won’t make your phone theft-proof, but they can buy you precious time to locate, lock, or erase your device before a thief gains access to your digital life.

If you enjoyed this week’s newsletter, you’ll find even more inside my new book, SPIES, LIES, AND CYBERCRIME. Drawing on my years hunting spies for the FBI, it reveals how espionage, cybercrime, and AI-powered deception intersect—and what you can do to stay one step ahead.

Ready for the next mission?

Already read the book? A quick review on Amazon or Goodreads helps more readers discover it. Thank you for your support.

Please support my sponsors. It only takes a click - no purchase necessary!

Shift your workforce into hyper-productivity mode with Dell Pro laptops powered by Intel® Core™ Ultra with Intel vPro®. Shop on Dell Premier.

Explore More

If someone forwarded you this newsletter, join more than 4,500 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

Whether it’s a North Korean operative posing as an American employee, a hacker manipulating a supermarket’s refrigeration system, or a thief racing away with your smartphone, the common vulnerability is our willingness to trust systems and identities without questioning how they might be exploited.

Technology continues to change the tools available to our adversaries. The fundamentals of security remain remarkably consistent.

Know who you’re trusting. Understand what you’re protecting. And verify before something goes wrong.

Stay safe out there and keep thinking like a spy hunter.

Praemonitus Praemunitus!

Forewarned is Forearmed!

~Eric