Loading story…
North Korea’s fraudulent remote IT worker operation is being used to infiltrate hiring pipelines and generate illicit revenue through front companies and intermediaries tied to the regime. Reporting on the scheme describes DPRK-linked personnel posing as remote developers and other technology workers, with the activity framed as a sustained effort to penetrate global hiring processes while concealing state involvement behind false identities and corporate cutouts.
New findings cited by DTEX indicate the proceeds flow far beyond individual fraud, feeding a broader state financing network that supports North Korea’s weapons programs, weapons manufacturing, and activity benefiting Russia’s war effort in Ukraine. Transaction data from a leaked North Korean payment server reportedly showed millions of dollars moving into sanctioned organizations including Sobaeksu, Saenal, Songkwang, and Korea Ryonbong General Corp, with SC Media highlighting $1.97 million routed through Korea Ryonbong between December 2025 and February 2026.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
DTEX reported that $1.97 million in payments moved through the sanctioned Korea Ryonbong General Corp as part of North Korea's fraudulent IT worker scheme. The report explicitly dates these flows to between December 2025 and February 2026.
DTEX reported that North Korea's fake IT worker scheme channels millions of dollars through front companies and sanctioned entities, supporting not only DPRK weapons programs but also broader regime objectives that benefit Russia's war effort in Ukraine. CyberScoop and SC Media both described the report's findings, including flows through entities such as Sobaeksu, Saenal, Songkwang, and Korea Ryonbong General Corp.
Opsek published research describing how North Korean IT workers infiltrate remote hiring processes. A Bluesky post amplified the publication and framed it as DPRK-linked remote hiring activity.
Kudelski Security published research analyzing infrastructure used by DPRK-linked fake IT workers and related offensive teams. The report described Russian exit nodes, shared VPN infrastructure, Skyfreight-linked IP use, mapped parts of the actors’ internal networks, and identified a newly added offensive cluster labeled PUG.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcebsky.app
Open sourcekudelskisecurity.com
Open sourceteam-cymru.com
Open sourcespur.us
Open sourcemsmt.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Jun 30, 2026
The U.S. Treasury Department’s **Office of Foreign Assets Control (OFAC)** sanctioned **six individuals and two entities** for supporting North Korean government-directed **fraudulent IT worker schemes** that covertly place DPRK nationals into jobs at legitimate companies (including U.S. firms) using **stolen identities, fake personas, and fraudulent documentation**. U.S. officials said the program generated **nearly $800 million in 2024**, with wages largely diverted to fund the DPRK’s **WMD and ballistic missile programs**, and noted that some IT workers have also been linked to **malware introduction and data theft/extortion** inside victim environments.
Jun 29, 2026
Open-source reporting detailed how North Korean entities market domestically developed software for foreign customers while also placing disguised IT workers into overseas jobs, underscoring a broader effort to generate revenue through the global technology sector. One report cataloged North Korean software offerings presented for export, indicating an organized commercial ecosystem that promotes applications and development services beyond the country’s borders. A separate OSINT analysis examined North Korean remote IT worker operations, describing how personnel allegedly conceal their identities to obtain employment with foreign companies. Together, the reports show Pyongyang-linked technology operations using both formal software export channels and covert freelance or remote employment schemes to earn foreign currency, creating compliance, insider-risk, and sanctions-enforcement concerns for organizations hiring distributed technical staff or sourcing software development services.
Jul 8, 2026