North Korea has increasingly turned to remote information technology workers from third countries, including Iran and Lebanon, to help infiltrate United States companies, according to a recent report by NBC News.
The strategy is designed to generate revenue to fund the country's weapons programs. According to a joint alert issued in July by the US government and several foreign agencies, North Korean IT workers seek contracts with the intent of sending their salaries back to parent agencies in North Korea. Authorities warn that these workers pose insider threats, engaging in data exfiltration, sensitive information theft, and cryptocurrency theft.
As governments implement countermeasures, North Korea has adapted by hiring third-country professionals to successfully pass job interviews. Once a contract is secured, the positions are typically handed over to North Korean operatives.
NBC reported that foreign IT workers have been scouted through platforms like LinkedIn, with some individuals offered $500 per month in cryptocurrency to act as part-time interview associates.
These tactics are part of a broader, highly lucrative illicit operation. Data from cybersecurity firm CrowdStrike cited by Cointelegraph in May indicated that North Korean state-affiliated hackers were responsible for more than $2 billion in cryptocurrency losses throughout 2025, marking a 51% increase year-on-year. Meanwhile, the Bank of Korea estimated that North Korea's gross domestic product grew by 3.5% in 2025 despite ongoing global sanctions.
