Inside North Korea’s Covert Operation: How Foreign Experts Are Breaching US Corporate Defenses

Ever wonder if your next remote coworker might be moonlighting as a secret agent? North Korea’s latest playbook has taken a twist worthy of a spy thriller—recruiting remote IT workers from places like Iran and Lebanon to sneak into US companies. These folks aren’t just clocking in for a paycheck; they’re lining up job interviews to open the door to cyber infiltration, funneling salaries back to their homeland to bankroll, you guessed it, weapons programs. It’s a wild game of digital double agents, where third-party workers essentially become the Trojan horses, handing over the reins once contracts are secured. And the kicker? Some are getting paid in crypto to play along as “interview associates”—a half-grand a month to help stage a cunning takeover. With North Korean hackers reportedly responsible for over $2 billion in crypto heists last year alone, these shadowy moves are more than just clever—they’re effective. If you thought your last Zoom interview was nerve-wracking, imagine the stakes when your potential teammate might actually be the adversary. Curious how deep this rabbit hole goes? LEARN MORE.

North Korea (DPRK) is now using remote workers from third countries, including Iran and Lebanon, to aid its efforts to infiltrate US companies and obtain money to fund its weapons programs, NBC reported on Friday.

An alert issued in July by the US government and several foreign agencies said North Korean IT workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”

As the US and other governments have moved to counter North Korea’s efforts, the DPRK has turned increasingly to third-country IT workers to pass job interviews, the report said. After work contracts are obtained, the positions are usually taken over by North Korean operatives.

NBC reported that foreign IT workers had been scouted on LinkedIn, with some offered $500 monthly in cryptocurrency to work part-time as “interview associates.”

The DPRK’s increasingly sophisticated tactics may be meeting with some success.

Cointelegraph reported in May, citing cybersecurity company CrowdStrike, that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025, a 51% year-on-year increase.

The Bank of Korea estimates North Korea’s GDP increased 3.5% in 2025 in spite of global sanctions.

Magazine: Bitcoin adoption metrics say one thing, price action says another

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.