North Korea is infiltrating U.S. companies through remote IT personnel recruited from third countries including Iran and Lebanon, with roles reportedly handed off to North Korean operators after interviews and salaries sent back to North Korean institutions.

The reported scheme relies on remote IT personnel based in third countries who secure jobs with U.S. companies and then transfer the work to North Korean personnel. According to the account, the arrangement is designed to generate funds for North Korea’s weapons programs while giving operators access to corporate systems from inside the organization.

In July, the U.S. government and several foreign agencies issued alerts warning that North Korean IT workers were seeking contracts and remitting their wages to North Korean institutions. Those alerts described the activity as an internal threat that could lead to data leaks, cryptocurrency theft, and exposure of sensitive information.

The report also said some third-country workers are recruited through LinkedIn to serve part-time as “interview assistants,” receiving $500 a month in cryptocurrency. That detail points to a wider support network around hiring, identity presentation, and payroll routing rather than a single direct-employment tactic.

Cybersecurity firm CrowdStrike said cryptocurrency losses attributed to state-linked North Korean hackers and threat actors will exceed $2 billion by 2025, representing a 51% year-on-year increase. While the current case centers on employment infiltration rather than a specific exploit, the warning places the activity within a broader pattern of North Korea-linked efforts to extract funds through cyber operations.

Why It Matters

This development matters because it shifts part of the North Korea cyber threat from perimeter defense to workforce trust and vendor management. For crypto companies, exchanges, infrastructure providers, and other firms handling digital assets, the risk is not limited to external attacks; it can begin with routine hiring, contractor onboarding, and privileged internal access.

It also broadens the policy and compliance angle. If authorities treat remote hiring networks as a sanctions, national security, and financial-crime issue, firms may need stricter checks on identity, geography, payroll destinations, and access permissions across globally distributed teams.