Skip to content

Topic

North Korean IT workers

North Korean nationals who take remote tech jobs under false identities, earning foreign currency for the state and gaining insider access to employers.

Current stories

leadershipOne report1 publisher

A remote IT hire at a New Zealand firm turned out to be a North Korean operative, the NCSC says

New Zealand's NCSC says a North Korean operative hired as a remote IT contractor threatened to leak a large business's sensitive data once exposed. Coder Trove counts five of the 10 steps in a fake remote hire as running through HR.

Publishers:hcamag.com

Reality

Evidence50
Adoption
Not scored
Hype gap+15
Incentives
Not scored
Confidence50
securityConfirmed17 publishers

DOJ seizes 187 laptops in raids on more than 40 Texas homes tied to North Korean IT workers

DOJ raided more than 40 Texas residences on September 21-25 and seized 187 laptops and other devices it says North Koreans used in an IT-worker scheme. The FBI says the workers now also hire freelancers in South Asia and West Africa, so US hosts are one intermediary among several.

Perspective Coverage

17 publishers
Builder
Builder 25%
Operator
Operator 55%
Investor
Investor 20%

Reality

Evidence80
Adoption
Not scored
Hype gap+25
Incentives55
Confidence78
securityOne report1 publisher

Remote-worker fraud spreads beyond North Korea to Pakistan, India and Russia, Okta says

Okta's Katie Nickels says fake remote IT workers now operate from Pakistan, India and Russia as well as North Korea, mixing AI with human techniques. That moves the first security check on a new employee into the hiring process.

Publishers:scworld.com

Reality

Evidence30
Adoption
Not scored
Hype gap+35
Incentives
Not scored
Confidence40
securityConfirmed8 publishers

Joint advisory pins WaterPlum's fake recruiters to North Korea's 313 General Bureau

Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.

Perspective Coverage

8 publishers
Builder
Builder 34%
Operator
Operator 52%
Investor
Investor 14%

Reality

Evidence70
Adoption
Not scored
Hype gap+5
Incentives40
Confidence72
securityOne report1 publisher

Sekoia and Kudelski split the Lazarus umbrella into six DPRK sub-clusters

The joint research argues that constant reorganization under the GRIB and NIA is a control mechanism rather than administrative noise, and that treating Lazarus as one actor hides the revenue mandate driving most of the intrusions.

Publishers:kudelskisecurity.com

Reality

Evidence38
Adoption
Not scored
Hype gap+18
Incentives62
Confidence48