Report says North Korea uses foreign talent to infiltrate U.S. companies

Analysis of North Korea's strategy of using third-country remote IT personnel to infiltrate U.S. companies

North Korea appears to be expanding its use of remote IT workers in third countries as part of its increasingly targeted strategy to infiltrate U.S. companies and channel funds towards its weapons programs, NBC News reported on Friday. The program involves foreign-based job seekers-often recruited through mainstream platforms-who are then arranged to obtain contracts and access rights, and then replaced by North Korean agents.

Core Points

• U.S. and allied agencies have warned that North Korean IT workers seek contracts to repatriate salaries back to North Korea-related agencies and pose an internal personnel and data risk threat.
• NBC reported that North Korea's efforts are increasingly relying on third-country remote workers to pass interviews and then hand over roles to North Korean agents.
• The recruitment strategy described by NBC includes scouting on platforms such as LinkedIn and providing cryptocurrency compensation for "interview assistant" jobs.
• Reports earlier this year linked North Korea-related hacking activities to large cryptocurrency losses, suggesting that this operating model may be working.
• As economic pressures continue, this initiative highlights why organizations should strengthen identity, access and payment controls for remote recruitment.

From direct recruitment to remote access to third countries

According to NBC, North Korea's approach has shifted to the practice of using people outside North Korea to enter companies that may not link threats to North Korea. The program no longer relies solely on traditional penetration channels, but instead focuses on obtaining a legal work contract after successfully passing the recruitment process.

The reported work process is simple but risky for employers: third-country IT workers are brought in to secure contracts, and once the role is established, they are often replaced by North Korean agents. The operating logic is clear and unambiguous-create a seemingly normal foothold from an external recruitment perspective, and then transition to lower-level actors with access to systems, credentials, or internal knowledge.

NBC also stated that some foreign workers were recruited after being spotted on LinkedIn. In other cases, applicants are allegedly paid in cryptocurrency to perform part-time "interview assistant" tasks-a job that can help them appear credible in the recruitment pipeline while potentially aligning them with long-term operational goals.

The July Alert and Its Implications for Enterprise Defense

The July Alert cited by NBC is significant because it views the threat not only as an external hack, but also as a multi-stage penetration risk that includes internal behavior. In the consultation, the U.S. government and partner agencies described North Korean IT workers as contract seekers interested in remitting proceeds to North Korean institutions.

Equally important, the alert connects the perspective of labor recruitment to network results. It describes how these workers act as internal threats to the company, while also involving data theft, cryptocurrency theft and sensitive information theft. Even without more details on each case in the NBC report, the comprehensive information suggests that the threat model includes both access and monetization.

For companies that handle remote hiring, this means that recruitment risks are inseparable from security risks. Organizations that rely on remote onboarding, contractor access, or loose internal tools may inadvertently open the way for identity compromise, unauthorized processing of code and data, and lateral movement after a "handover" occurs.

Why cryptocurrencies appear in the recruitment workflow

NBC's report on some candidates receiving cryptocurrencies as part of an "interview assistant" arrangement is important for two reasons. First, it suggests that recruitment pipelines may be designed to integrate into existing work structures while still using mechanisms that are more difficult to track than traditional wages.

Second, this is consistent with earlier warnings and reports that linked North Korea-related actors to cryptocurrency-driven theft and financial transfers. In May, Cointelegraph cited a report from cybersecurity firm CrowdStrike that North Korean state-associated hackers and threat actors caused more than $2 billion in cryptocurrency losses in 2025, a year-on-year increase of 51%. Although this number reflects widespread cyber theft rather than the specific "interview assistant" step described by NBC, the clue is consistent: Cryptocurrency is both a tool and a result of North Korean-related operations.

Sanctions pressure, economic indicators and sustainability

Despite the sanctions, this recruitment strategy is also consistent with a broader pattern of sustained activity. The report noted that the Bank of Korea estimates North Korea's GDP will grow by 3.5% in 2025, although global restrictions remain in place. This resilience can be seen as a reminder that threat actors do not need trade normalization to maintain operations-alternative channels, including cybercrime and illegal financial routing, can help fill the gap.

For investors and builders in cryptocurrencies and the broader technology ecosystem, the impact goes beyond national security. According to reports, North Korea's related tactics combine labor penetration, network manipulation and monetization. This combination increases the likelihood that compromised systems, stolen credentials, and stolen data feed downstream fraud and theft-which may involve cryptocurrency at multiple stages.

As governments and companies tighten controls around known malware and exchange abuses, options that start with recruitment and onboarding may be more attractive because they can bypass purely technological border defenses.

Follow-up Focus

The next thing to see is whether more enforcement and consulting provide fine-grained metrics-such as specific behaviors during remote recruitment, payment patterns, or contract approval structures-that organizations can use for early screening. At the same time, the core issue is clear: If role transition from third-country contractors to North Korean agents is a recurring strategy, security teams should assume that "legal" employment paths can mask hostile intentions.