Defense Firm Cyber Threats Increase in 2025

Foreign infiltration attempts rise over 50% as the Justice Department moves against a North Korean IT worker scheme.

Updated on Oct. 21, 2026 in Cybersecurity

Defense Firm Cyber Threats Increase in 2025

Live Poll

Do you trust that private companies are doing enough to verify the identity of job applicants?

Federal agencies report a surge in insider cyber threats and foreign attempts to infiltrate U.S. defense firms, marked by a critical incident increase of over 50%. Simultaneously, the Justice Department has arrested individuals linked to a long-running scheme where North Korean IT workers infiltrated over 70 U.S. companies.

Why it matters

The rise in sophisticated infiltration efforts highlights the growing challenge defense contractors face in vetting remote employees and securing sensitive data. These activities aim to compromise national security interests while generating significant illicit revenue.

Credential theft now costs companies approximately $4.8 million annually, while firms face a mean of 81 days to contain an insider threat. Foreign actors frequently exploit subject matter experts to gain research data access.

The players

Justice Department

The U.S. executive department responsible for enforcing federal law, prosecuting criminal activity, and overseeing national security-related investigations.

DCSA

The Defense Counterintelligence and Security Agency, which manages personnel security and protects the integrity of the U.S. defense research base.

The details

Foreign entities employ remote desktop software to maintain persistent access to employment-related devices. By submitting fraudulent resumes, these actors position themselves as legitimate subject matter experts within defense-adjacent organizations. This persistent access allows for the covert exfiltration of research data and the compromise of internal network credentials.

2019–2025: Duration of the identified North Korean IT worker scheme.
2023: Companies reported 28,000 suspicious contacts.
2024: Companies reported approximately 32,000 suspicious contacts.
Fiscal year 2025: Reporting period for the 22,000 suspicious contacts.

The Tech Race

This activity follows the 2022 suspicious contact reporting baseline, documenting a shift in how foreign entities target cleared defense companies. The surge in critical incidents demonstrates that despite increased defensive scrutiny, foreign actors remain highly active in the U.S. labor market.

Defense contractors and firms handling sensitive federal research must now account for higher vetting costs and potential disruptions caused by remote infiltration. Companies are facing heightened pressure to implement rigorous credential verification to mitigate the $4.8 million average cost of annual theft.

The takeaway

The sustained effort to place unauthorized IT workers in U.S. firms underscores a permanent shift in how foreign intelligence services approach corporate infiltration. Industry participants should monitor upcoming DCSA reporting for new indicators of compromise related to remote desktop software use.