North Korea's Global IT Infiltration Scheme Unveiled

North Korea has expanded its operation to infiltrate US tech companies by recruiting IT professionals in various countries, including Nigeria, South Africa, Iran, and India. These proxy workers are paid approximately $500 monthly, often via cryptocurrency, to facilitate the placement of fraudulent employees at American corporations.

The North Korean agents assume control of the positions after securing employment contracts and funnel wages back to Pyongyang, generating between $600 million and $800 million per year for the regime.

Intelligence estimates suggest that this operation is part of a broader campaign that includes cryptocurrency theft, which resulted in over $2 billion in damages during 2025. The US State Department and Justice Department released a coordinated advisory with international partner agencies, noting that North Korea employs 'increasingly sophisticated' methods to enlist individuals beyond its borders for concealing operative identities.

North Korean handlers actively pursue software developers through professional networking sites like LinkedIn, offering them roughly $500 per month to serve as 'interview stand-ins.' Nations such as Iran represent prime targets due to restricted opportunities for legitimate international employment under existing sanctions regimes.