North Korea12 September, 20262 min read
North Korea Expands Remote IT Infiltration Of U.S. Companies With Iran And Lebanon Workers
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
North Korea recruits foreign IT workers to pose as remote employees in U.S. companies. Recruits in third countries (Iran, Lebanon, Nigeria, South Africa, India) are paid about $500 monthly.
5 outlets told this the same way.
Remote workers as cover
North Korea’s remote IT-worker scheme to infiltrate U.S. companies has expanded to include remote workers from third countries, including Iran and Lebanon, according to NBC News and U.S. government and foreign agencies. The July alert described North Korean IT workers as seeking out contracts with the intent of remitting salaries to their parent North Korean agencies and as posing an insider threat to companies, including involvement in data exfiltration, cryptocurrency theft, and theft of sensitive information.
NBC News said the scheme is estimated to involve thousands of workers applying to hundreds of American companies, generating hundreds of millions of dollars a year that U.S. government agencies say are laundered and used to fund illicit weapons programs. The reporting also says that once work contracts are obtained, the positions are usually taken over by North Korean operatives, with foreign targets sometimes participating in job interviews and sometimes establishing in-person contact before a North Korean agent takes over.
$500 interview associates
NBC News reported that in some cases foreign targets were identified on LinkedIn, given onboarding instructions and offer letters from North Korean teams, and later paid in cryptocurrency.
Flare’s investigation, as described by NBC News, said that in some instances recruits were offered $500 a month to serve as part-time “interview associates” and were coached to use false identities.
Adrian Cheek, a senior cybercrime researcher at Flare, said, "It’s not a technical response to a problem; it’s now moving towards a physical response to a technical problem," describing how the scheme’s human intervention is meant to overcome technical protections.
The reporting also said the United Nations estimates the schemes generate as much as $600 million annually, while the U.S. State Department-led sanctions monitoring assessment placed earnings for 2024 as high as $800 million.
Countries named, risks widened
NBC News said Iran is part of a growing list of countries including Syria, Lebanon, South Africa and Saudi Arabia that researchers have cited as places where North Korean teams enlist people to conduct on-camera interviews with Western companies. Business Insider Africa reported that African countries such as South Africa and Nigeria, as well as nations like Iran and India, are increasingly being targeted to recruit facilitators who assist with job interviews and identity obfuscation.
The reporting described how Kudelski Security found North Korean IT workers delegating parts of the interview process to developers elsewhere who can pose as candidates and sometimes assist in passing technical tests, including developers in Iran, Syria and South Africa. NBC News also said U.S. authorities and companies have taken steps to counter the ruse, and that the scheme’s expansion is tied to how North Korea adapts as hiring checks tighten, including the use of tools to identify red flags and potential fraud.