North Korea Recruits Foreign IT Workers to Infiltrate US Companies

North Korea is increasingly relying on remote IT workers from countries such as Iran and Lebanon to help infiltrate US companies, according to a report from NBC. These third-country workers are used to pass job interviews and background checks, after which North Korean operatives quietly take over the positions once contracts are secured.

Government Alert Warns of Insider Threats

A July alert from US authorities and allied agencies described North Korean IT workers as intent on funneling their salaries back to state agencies while posing as insider threats. Officials said these workers have been linked to data exfiltration, cryptocurrency theft, and the theft of sensitive company information.

Workers Scouted on LinkedIn for Cryptocurrency Pay

According to the report, foreign IT workers have been recruited through LinkedIn, with some offered $500 a month in cryptocurrency to serve as part-time “interview associates” who help disguise the scheme.

Scheme Tied to Billions in Crypto Losses

The tactic appears to be paying off for Pyongyang. Cybersecurity firm CrowdStrike previously found that North Korean state-linked hackers were responsible for more than $2 billion in cryptocurrency losses in 2025, a 51 percent increase from the previous year.

North Korea’s Economy Grows Despite Sanctions

Despite ongoing international sanctions, the Bank of Korea estimated that North Korea’s GDP grew 3.5 percent in 2025, suggesting these illicit funding schemes may be helping sustain the country’s economy and weapons programs.