North Korea reportedly uses foreign IT workers to infiltrate US companies
North Korea using foreign IT workers to win US contracts
North Korea is using remote IT workers from third countries, including Iran and Lebanon, to help infiltrate US companies and obtain money to fund its weapons programs, NBC reported on Friday.
Foreign workers are used to pass job interviews, according to the report. Once a contract is obtained, the position is usually taken over by North Korean operatives.
How the scheme works
According to NBC, foreign IT workers were scouted on LinkedIn. Some were offered $500 per month in cryptocurrency to work part-time as "interview associates."
NBC reported that as the US and other governments have moved to counter North Korea's efforts, the country has turned increasingly to third-country IT workers to pass job interviews.
What the US government alert says
A July alert from the US government and several foreign agencies said North Korean IT workers "seek out contracts with the intent of remitting their salaries to their parent North Korean agencies."
The alert also said these workers pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.
Key numbers
- Cointelegraph reported in May, citing cybersecurity firm CrowdStrike, that North Korean state-affiliated hackers were responsible for more than $2 billion in crypto losses in 2025, a 51% year-on-year increase.
- The Bank of Korea estimates North Korea's GDP grew 3.5% in 2025 despite global sanctions.
Why it matters
NBC said North Korea's increasingly sophisticated tactics may be meeting with some success. That outcome is not confirmed.
According to the July alert, North Korean IT workers are not only a funding source for the regime but also an insider threat involved in cryptocurrency theft and data theft.
What is still unclear
Whether the scheme is actually succeeding is not confirmed. NBC's report describes possible success, not a verified outcome.
