My Philly Daily On Crime Column: North Korean Bad Actors

Philly Daily ran my On Crime column today.

You can read the column via the link below or the following text:

Paul Davis: North Korean bad actors – Philly Daily  

Prior to becoming a full-time writer in 2007, I was a Defense Contract Management Agency (DCMA) civilian employee. The agency oversaw defense contractors, from major corporations to mom & pop shops, for the various military buying commands that purchased such diverse items as cruise missiles, specialized parachutes for special operators and food and medical supplies.

I became a Defense Department civilian after serving four years in the U.S. Navy - two years on an aircraft carrier during the Vietnam War, and another two years on a Navy yard tugboat at the U.S. nuclear submarine base at Holy Loch, Scotland.

As the long-time administrative officer of the DCMA command in Philadelphia, which oversaw contractors in the tri-state area back then, I wore several “hats,” but my primary job was overseeing security programs for the command’s military and civilian employees. The security programs I coordinated and provided briefings and seminars on ranged from counterintelligence, counterterrorism and cyber security to information security and physical security.

Our team sought to protect military classified information from the “bad actors,” which is what the U.S. intelligence community called our adversaries such as the Soviet Union (later the Russian Federation), China, Iran and North Korea.

Nearly half of our employees were quality assurance specialists (QAS) who were stationed at the defense contractors’ plants and offices. The Philadelphia region, then and now, hosted many defense contractors.

I worked with the Defense Security Agency (now called the Defense Counterintelligence and Security Agency – DCSA) and the defense contractors’ security officers regarding security issues, especially after 9.11. There were cases of procurement fraud and security breaches, and I recall one case in which a contractor employee was exposed as a Communist Chinese spy. 

So, I was much interested in the case of a defense contractor employee who pled guilty to conspiracy to commit wire fraud relating to a scheme involving fraudulent applications for remote employment using borrowed U.S. identities that benefited North Korea.

According to the U.S. Attorney for the Eastern District of Virginia, from June to August 2025, John Allen Kurrle Jr., 62, was employed by a defense contractor for the U.S. government and held an active Top Secret security clearance with access to secret compartmented information (SCI).

“During that time, Kurrle participated in a scheme to defraud U.S. companies, including U.S. government contractors, in which he allowed foreign individuals to use his identity to apply for remote work positions and to fraudulently use the identity of a third person to apply for remote positions,” the U.S. Attorney’s Office (USAO) explained.

“In addition to allowing the use of his identity to apply for remote work positions, Kurrle received laptops shipped by victim companies to his home in Gainesville and enabled remote access from outside the United States. The applications using Kurrle’s identity or a stolen identity induced nine job offers from U.S. companies,” the USAO explained.

“To evade economic sanctions and earn money for the Democratic People’s Republic of Korea (North Korea), the North Korean government has dispatched thousands of IT workers to obtain remote employment with companies around the world. North Korean IT workers are aided in this fraud by people residing in the United States who facilitate the scheme by receiving and hosting computers and other hardware issued by U.S. victim companies. In exchange, U.S. facilitators are paid a fee.”

Kurrle is scheduled to be sentenced on Jan. 28, 2027. He faces up to 20 years in prison.

The FBI recently released information advising that North Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.

The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

“The FBI, together with partners at the U. S. Secret Service (USSS) and the IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ether (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the FBI stated.

“The FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.

“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea's illicit cybercrime and virtual asset theft activities. If you have any information to provide, please contact your local FBI field office or the Internet Crime Complaint Center at ic3.gov.”

Paul Davis’s On Crime column appears here each week. He can be reached via pauldavisoncrime.com.