On October 28, 2026, the U.S. Attorney’s Office for the Eastern District of Virginia announced that John Allen Kurrle Jr., 62, of Gainesville, Virginia, pleaded guilty to conspiracy to commit wire fraud for his role in a North Korean remote IT worker scheme. According to the release, Kurrle worked for a defense contractor supporting the U.S. government and held an active Top Secret security clearance with access to sensitive compartmented information (SCI).
This case is a reminder that insider risk is not only about someone walking out with secrets. Sometimes a trusted insider lends out the most valuable thing they have: their identity, and the trust that comes with it.
What happened
- From June to August 2025, Kurrle took part in a scheme to defraud U.S. companies, including U.S. government contractors.
- He allowed foreign individuals to use his identity to apply for remote work positions.
- He also used a third person’s identity, without that person’s authorization, to apply for remote positions.
- Victim companies shipped laptops to his home in Gainesville, and he enabled remote access to them from outside the United States.
- The applications made under his identity and the stolen identity led to nine job offers from U.S. companies.
- He pleaded guilty before U.S. District Judge Michael S. Nachmanoff. Sentencing is scheduled for January 28, 2027, and he faces a maximum penalty of 20 years in prison.
- The FBI investigated the case.
The release explains the bigger picture: to evade sanctions and earn money for the regime, North Korea has dispatched thousands of IT workers to obtain remote jobs with companies around the world, aided by people in the United States who receive and host company-issued hardware in exchange for a fee. We covered how these schemes reach government contractors in Unwitting Accomplices: How North Korean IT Workers Can Reach Government Contractors Through Hiring and Vendors.
Lessons for every insider threat program
- Treat a cleared identity as an asset that can be lent out. The scheme traded on the identity of someone already trusted by a defense contractor. Training for cleared staff should state plainly that letting anyone else use your name, credentials, or clearance status to get work is serious misconduct, and outside employment reporting should be taken seriously.
- Verify the person, not just the paperwork. An application built on a real, cleared identity can pass resume screening and records checks. Live, on-camera identity checks matched against government ID at interview, at onboarding, and again when equipment is issued close that gap.
- Know where company laptops are and who is driving them. Here, laptops sat in a home in Virginia while someone outside the country operated them. User activity monitoring and endpoint telemetry should flag remote-control tools, foreign or anonymized connections, and activity patterns that do not match the employee’s location and schedule.
- Connect HR, IT asset, and security data. A single residential address receiving laptops for multiple new hires, or the same address, phone, or bank details appearing across applicants, is a signal that no one team sees alone. Shared indicators turn scattered data points into a lead.
- Bring vendors and subcontractors into scope. The victims included government contractors. Primes should require staffing vendors and subcontractors to perform identity verification and report anomalies, and should monitor contractor accounts with the same rigor as employee accounts.
How TMPC helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- User activity monitoring and analytic triage that surface remote-access tools, foreign connections, and activity that does not fit the user.
- Insider threat program design, including hiring and onboarding identity-verification procedures and workforce training.
- Vendor and subcontractor insider risk reviews for prime contractors and their supply chains.
To talk with our team, contact info@tmpcinc.com or 813.524.6935.