In a significant development, North Korea has broadened its long-running remote work infiltration scheme by enlisting freelancers from countries such as Iran and Lebanon to help its operatives sneak into US companies, according to a Friday report from NBC. The tactic is aimed at generating revenue for Pyongyang’s weapons development programs.
A joint advisory released in July by the US government and partner agencies described how North Korean IT workers pursue employment contracts specifically to funnel their earnings back to state agencies at home. The advisory also warned that these workers create serious security risks once embedded inside companies, engaging in activities such as stealing sensitive data and cryptocurrency.
As Western governments have cracked down on North Korean nationals directly seeking this kind of employment, Pyongyang has adapted by relying more heavily on workers from other nations to get through the hiring process, NBC’s report noted. Once a contract is secured, the actual work is quietly transferred to operatives based in North Korea.
The scheme typically begins with recruiting freelance workers through sites like LinkedIn, where they are used to pass interviews and land jobs before handing control over to North Korean handlers. Some recruits were reportedly paid around $500 a month in crypto for part-time positions described as “interview associate” roles, essentially standing in during the hiring process on behalf of someone else.
A blockchain analytics firm tied this network to some of the largest crypto heists on record, including the $1.5 billion theft from Bybit and the $235 million WazirX breach. Investigators found that North Korean-linked hackers have been using laundering services that swap easily traceable stolen crypto for stablecoins obtained through unrelated criminal activity, making the funds harder to trace.
In response to this laundering infrastructure, the US Treasury’s Office of Foreign Assets Control sanctioned the platform Xinbi on September 9, along with two associated tech firms, SafeW Technology and Anwen Technology.
