North Korea (DPRK) is now using remote workers from third countries, including Iran and Lebanon, to aid its efforts to infiltrate US companies and obtain money to fund its weapons programs, NBC reported on Friday.
An alert issued in July by the US government and several foreign agencies said North Korean IT workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”
As the US and other governments have moved to counter North Koreas efforts, the DPRK has turned increasingly to third-country IT workers to pass job interviews, the report said. After work contracts are obtained, the positions are usually taken over by North Korean operatives.
NBC reported that foreign IT workers had been scouted on LinkedIn, with some offered $500 monthly in cryptocurrency to work part-time as “interview associates.”
Related: Consensys unknowingly outsourced developer work to North Korean
The DPRKs increasingly sophisticated tactics may be meeting with some success.
Cointelegraph reported in May, citing cybersecurity company CrowdStrike, that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025, a 51% year-on-year increase.
The Bank of Korea estimates North Koreas GDP increased 3.5% in 2025 in spite of global sanctions.