Loading story…
Open-source reporting detailed how North Korean entities market domestically developed software for foreign customers while also placing disguised IT workers into overseas jobs, underscoring a broader effort to generate revenue through the global technology sector. One report cataloged North Korean software offerings presented for export, indicating an organized commercial ecosystem that promotes applications and development services beyond the country’s borders.
A separate OSINT analysis examined North Korean remote IT worker operations, describing how personnel allegedly conceal their identities to obtain employment with foreign companies. Together, the reports show Pyongyang-linked technology operations using both formal software export channels and covert freelance or remote employment schemes to earn foreign currency, creating compliance, insider-risk, and sanctions-enforcement concerns for organizations hiring distributed technical staff or sourcing software development services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
North Korean Internet published a report titled "Made for Export: North Korea’s Software Catalog," describing North Korean software offerings and export-related activity.
Logpresso published an OSINT analysis report on North Korean IT workers obtaining disguised employment, detailing the activity as part of its CTI reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea’s fraudulent remote IT worker operation is being used to infiltrate hiring pipelines and generate illicit revenue through front companies and intermediaries tied to the regime. Reporting on the scheme describes DPRK-linked personnel posing as remote developers and other technology workers, with the activity framed as a sustained effort to penetrate global hiring processes while concealing state involvement behind false identities and corporate cutouts. New findings cited by DTEX indicate the proceeds flow far beyond individual fraud, feeding a broader state financing network that supports North Korea’s weapons programs, weapons manufacturing, and activity benefiting Russia’s war effort in Ukraine. Transaction data from a leaked North Korean payment server reportedly showed millions of dollars moving into sanctioned organizations including **Sobaeksu**, **Saenal**, **Songkwang**, and **Korea Ryonbong General Corp**, with SC Media highlighting **$1.97 million** routed through Korea Ryonbong between December 2025 and February 2026.
Jul 22, 2026
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Jun 30, 2026
Reporting highlighted ongoing **North Korean IT worker** operations in which individuals use **stolen identities, falsified resumes, and AI-enabled deepfakes** to obtain remote roles at Western companies, creating direct insider-risk exposure once hired. The activity was described as affecting **thousands** of workers and **Fortune 500** employers, with claims of "**3,000 hands on keyboards**" and roughly "**30,000 different email addresses**" in use to support multiple personas, generating wages that can total **hundreds of millions of dollars annually** and help fund the North Korean regime. Recommended screening and verification measures focused on practical controls for remote hiring, including prompting candidates to **perform live actions on video** (e.g., wave), validating **IP address/geolocation consistency** with claimed location, and probing discrepancies in a candidate’s stated whereabouts. The reporting framed these checks as necessary to counter identity fraud and synthetic media used to pass interviews and onboarding, and to reduce the likelihood of granting network access to sanctioned or malicious actors operating under false identities.
Jun 29, 2026