SKN | North Korea Uses Third-Country IT Workers to Infiltrate US Firms, Report Says

Key Points

• North Korea is reportedly using IT workers from third countries, including Iran and Lebanon, to help secure employment with US companies and bypass efforts targeting its remote-worker schemes.
• US and international agencies have warned that North Korean IT workers can pose insider threats involving data theft, cryptocurrency theft and the transfer of earnings to North Korean entities.
• The activity comes amid growing losses attributed to North Korean cyber actors, with more than $2 billion in cryptocurrency reportedly stolen in 2025.

North Korea Expands Remote Worker Infiltration Tactics

North Korea is reportedly adapting its remote-worker operations by using IT professionals from third countries to help infiltrate US companies and generate revenue for the regime.

According to NBC News, foreign IT workers from countries including Iran and Lebanon have been recruited to participate in North Korean employment schemes. These workers can reportedly help North Korean operatives overcome job-screening processes that have become more difficult as US companies and governments increase efforts to identify DPRK-linked applicants.

After employment contracts are secured, North Korean operatives may take over the positions, according to the report.

The approach represents an evolution of a broader campaign in which North Korea has sought access to foreign companies through remote technology jobs while concealing the identities and locations of its personnel.

Government Agencies Warn of Insider Threats

A US government alert issued in July, alongside warnings from several foreign agencies, said North Korean IT workers seek contracts with the intention of sending their salaries to North Korean organizations.

The agencies also warned that these workers can present an insider threat after gaining access to corporate systems.

Potential activities include the theft of cryptocurrency, exfiltration of corporate data and acquisition of sensitive information.

The use of legitimate employment relationships can make the activity particularly difficult to detect. Once workers gain access to internal systems, company information and financial infrastructure, the threat can extend beyond the original hiring process.

Foreign Workers Recruited as “Interview Associates”

NBC reported that some foreign IT workers were recruited through LinkedIn and offered approximately $500 per month in cryptocurrency to work part-time as “interview associates.”

Their reported role was to participate in employment interviews on behalf of North Korean IT workers, helping the eventual operatives obtain positions they might otherwise struggle to secure.

The development highlights how North Korean operators are adapting their techniques in response to stronger screening and enforcement measures.

Rather than relying exclusively on North Korean nationals to obtain remote employment, the reported strategy introduces intermediaries who can make candidates appear more credible during the recruitment process.

Crypto Theft Remains a Major Revenue Channel

The reported employment infiltration campaign adds another layer to North Korea’s broader cybercrime operations, which have generated significant cryptocurrency losses.

Cybersecurity company CrowdStrike previously estimated that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in cryptocurrency losses during 2025, representing a 51% increase from the previous year.

Cryptocurrency theft has become a particularly important concern because digital assets can potentially be transferred across borders without relying on conventional banking infrastructure.

The July government alert specifically identified cryptocurrency theft alongside data exfiltration and sensitive-information theft as activities associated with North Korean IT worker operations.

Sanctions Have Not Eliminated Revenue Generation

North Korea’s reported cyber and employment activities are occurring despite extensive international sanctions targeting the country.

The Bank of Korea estimated that North Korea’s gross domestic product expanded by 3.5% in 2025, suggesting that sanctions have not prevented the economy from generating growth through various domestic and external revenue channels.

The continued development of remote-worker and cyber operations indicates that North Korea remains focused on finding alternative sources of foreign currency and digital assets.

Outlook

The reported use of third-country IT workers demonstrates how North Korea’s remote employment operations are evolving as companies strengthen hiring controls. For US businesses, the threat extends beyond fraudulent employment credentials to potential insider access, data exfiltration and cryptocurrency theft. As North Korean operators continue adapting their methods, corporate cybersecurity and employee-verification procedures are likely to face greater scrutiny, particularly for remote positions with access to sensitive financial or technical systems.