DPRK Infiltration Tactics Shift to Third-Country IT Workers

The Democratic People's Republic of Korea (DPRK) has found a new way to infiltrate US companies and fund its weapons programs. According to a report, North Korea is now using remote workers from third countries, including Iran and Lebanon, to aid in this effort.

The alert issued by the US government in July warned that North Korean IT workers 'seek out contracts with the intent of remitting their salaries to their parent North Korean agencies.' These workers are often scouted on LinkedIn and offered a monthly salary in cryptocurrency, reportedly up to $500 for part-time work as 'interview associates.'

Once a contract is obtained, the position is usually taken over by a North Korean operative. This tactic has been successful in some cases, with estimates suggesting that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025.