North Korea is using remote IT workers from third countries, including Iran and Lebanon, to help infiltrate US companies and raise money for its weapons programs, NBC reported Friday.
According to the report, Pyongyang has leaned more heavily on foreign-based workers as the US and other governments have stepped up efforts to disrupt North Korean employment schemes. Those third-country workers are used to pass job interviews, and once contracts are secured, the positions are typically taken over by North Korean operatives.
A July alert from the US government and several foreign agencies said North Korean IT workers "seek out contracts with the intent of remitting their salaries to their parent North Korean agencies." The alert added that they also pose an insider threat to companies and have been involved in data exfiltration, cryptocurrency theft and the theft of sensitive information.
NBC said foreign IT workers were approached through LinkedIn, and some were offered $500 per month in cryptocurrency to work part-time as "interview associates."
Earlier reporting and figures
Cointelegraph previously reported that Consensys had unknowingly outsourced developer work to North Koreans.
The report said North Korea’s tactics are becoming more sophisticated and may be producing results.
In May, Cointelegraph cited cybersecurity firm CrowdStrike as saying that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025, up 51% from a year earlier.
The Bank of Korea has also estimated that North Korea’s GDP grew 3.5% in 2025 despite global sanctions.