North Korea uses remote foreign employees to infiltrate the United States...

How has North Korea changed its remote workforce strategy?

North Korea is increasingly using remote skilled workers from third countries such as Iran and Lebanon to help infiltrate U.S. companies and generate revenue for national projects, according to a report released Friday. The strategy is designed to circumvent a more stringent screening process for job seekers believed to have direct ties to North Korea.

Foreign workers can handle interviews and other early stages of recruitment before their positions are transferred to North Korean agents, and control will be transferred once an employment contract is established. An alert issued in July by the U.S. government and several foreign agencies warned that the main purpose of North Korean IT workers seeking remote contracts is to remit salaries back to domestically operating agencies. The warning pointed out that the risks posed by such activities far outweigh sanctions evasion itself. In addition, North Korean workers have been linked to data theft, cryptocurrency theft and access to sensitive corporate information, all after they gain access to company systems.

Recruitment through third-country intermediaries may make it more difficult for employers to discover these plans because the person completing the interview may not be the individual who ultimately visits the company's network or performs contractually agreed work.

How are foreign workers recruited?

The report points out that potential middlemen are approached through professional online platforms such as LinkedIn. According to reports, some foreign IT workers receive about US$500 a month in cryptocurrency and work part-time as "interview agents." Their roles include participating in remote interviews, communicating with employers, and helping North Korean operators pass identity and recruitment reviews. Once the contract is awarded, control of the job may be transferred to another worker. This model adds another layer of isolation to North Korean operations, making traditional identity checks less effective. Although company credentials, source code, or customer information are subsequently handled by different people, there may still be legal individual participation during the recruitment period.

Using cryptocurrency payments also allows funds to flow across borders without relying entirely on traditional banking infrastructure.

Investor Revelation

North Korea's use of third-country interviewers has turned remote recruitment into a cybersecurity and counterparty risk issue. Companies involved in sensitive data, digital assets or payment infrastructure may need to establish controls to verify workers throughout the employment process, not just during induction.

Why is this critical for cryptocurrencies and technology companies?

The threat is particularly relevant to cryptocurrency companies because remote development work, cross-border recruitment, and access to digital wallets can create multiple routes of theft after an attacker obtains legal credentials. North Korean affiliated groups have been blamed for some of the largest cryptocurrency thefts in recent years. Cybersecurity firm CrowdStrike estimates that North Korea's state-affiliated hackers and other threat actors caused more than $2 billion in cryptocurrency losses in 2025, a 51% increase from the previous year.

Remote employment solutions provide a different way to corporate intrusion than traditional hacking attacks. Instead of exploiting external software vulnerabilities, operators can gain authorized access through the normal recruitment process, and then use that access to collect data, identify valuable internal systems, or support subsequent attacks. Risks are not limited to the cryptocurrency space. Software developers, technology contractors, and other remote employees may have access to source code, cloud infrastructure, internal communications, and commercially sensitive information, which may be exploited or transferred without immediately leading to financial theft.

Can the government curb this plan?

U.S. authorities and allied governments have stepped up warnings about remote worker operations in North Korea, but the growing number of intermediaries suggests that relevant networks are adapting to these controls. As a result, companies that rely heavily on remote recruitment may face greater pressure to continuously verify identities, monitor abnormal access patterns, and confirm that the individual operating the company's systems is the same person completing the recruitment process.

The economic incentives behind the action remain huge. North Korea continues to face international sanctions aimed at limiting funding for its weapons program, making foreign technology employment and cryptocurrency theft important sources of hard currency. Despite restrictions, North Korea's economy is also showing signs of growth. The Bank of Korea estimates that North Korea's gross domestic product (GDP) will grow by 3.5% in 2025.

The use of workers in third countries shows that Pyongyang is no longer just concealing the nationality of its own developers. By inserting legitimate foreign applicants into the recruitment process, the North Korean network can make employment relationships appear normal before handing over access to operators who have never been directly reviewed by employers. The shift has increased testing costs for U.S. companies and highlighted the importance of monitoring identities, equipment and access behavior over the long term after initial interviews.