North Korea’s Hidden IT Workforce Exposed in New Report

A cybersecurity firm is shedding light on how North Korea built an international cybercrime scheme involving fake information technology workers hired by major global businesses that siphon money to the Hermit kingdom and help fund its military ambitions.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

A report from DTEX shows that North Korean operatives, driven by survival rather than ideology, are trained from childhood to become military cyber agents or covert IT contractors. Researchers identified two operatives living in Russia using the falsified identities “Naoki Murano” and “Jenson Collins,” each suspected of infiltrating Western firms and linked to a $6 million cryptocurrency heist.

North Korea operates IT fronts like Chinyong, a so-called IT cooperation company that places operatives in China, Laos and Russia posing as freelance developers who exploit trusted access to blockchain projects to funnel cryptocurrency back to the regime. Since 2017, the group has apparently siphoned tens of millions of dollars and has been sanctioned by the United States for financing Pyongyang’s weapons programs (see: US Sanctions North Korean Entities for Sending Regime Funds).

The report warns that North Korea’s cyber program has hit a critical inflection point, using increasingly aggressive and unconventional tactics to target global victims. From chaining together supply chain hacks to infiltrating financial firms and launching propaganda campaigns, the regime is expanding its reach. Its IT operatives have embedded so deeply in Fortune 500 companies and cryptocurrency projects “it would seem that every other Web3 project has a North Korean on the payroll,” the researchers said.

“The threat of unintentionally hiring North Korean IT workers is larger than most people realize,” Kevin Mandia, founder and former CEO of Mandiant, said in a statement accompanying the report. “It’s cover, it’s global and it’s active right now – which is why industry and government need to work together to come up with solutions to counter the threat.”

The report reveals a fluid system where operatives move between missions, take on managerial roles and reuse old personas – contradicting assumptions that roles are rigid or that veteran North Korean hackers simply disappear.

Previous reports have shown North Korean attacks on European tech firms were often enabled by “facilitators” operating from the United Kingdom or the United States. An April report from Mandiant warned that North Korean workers actively pursued roles in the defense sector and government agencies, with U.S. companies remaining the primary target even as activity spreads across Europe (see: North Korean IT Scammers Targeting European Companies).

Michael Barnhart, the lead author of the DTEX report, said his findings draw from open-source intelligence, defector accounts, cryptocurrency analysis and Web3 infrastructure. He also used sensitive datasets from unnamed partners to piece together the regime’s cyber operations and trace how its operatives move money, access and identities across borders.

“DPRK operatives are persistent,” Barnhart wrote, warning that North Korean threat actors “do not take kindly to scrutiny” and “will try to uncover who is studying them and how.”