Now recruiting: North Korea looks abroad for talent in its scheme to infiltrate U.S. companies

Live updates

1. 29d ago

   North Korean Hackers Steal Millions via Fake Job Scams

   Australia's cyber agency, alongside partners in the United States, Japan, and Germany, revealed that the North Korean hacking group WaterPlum stole $10.71 million in cryptocurrency. The group targeted IT workers by luring them with fraudulent job interviews. This operation aligns with broader North Korean remote IT worker schemes involving fake tech recruitment fronts, malicious coding assignments, and stolen American identities designed to infiltrate U.S. companies and infect global devices.

   Why it matters

   International authorities previously connected WaterPlum and similar infrastructure to widespread remote IT worker operations that have infected over 30,000 devices worldwide. Operatives have historically utilized artificial intelligence and laptop farms operated by U.S. citizens to mask their true locations and secure employment. Five individuals recently pleaded guilty to related IT worker fraud and cryptocurrency theft charges.

   What is confirmed

   • Australia's cyber agency and partners in Japan, the US and Germany stated that the North Korean group WaterPlum stole $10.71 million in crypto from IT workers lured by fake job interviews.

   What to watch next

   • Additional international indictments or sanctions targeting WaterPlum operatives
   • Further joint advisories from U.S., Australian, Japanese, and German cyber agencies regarding fake recruitment infrastructure
   Sources used for this update (2)

   1. cryptonews.com.au — Australia Warns Fake Job Scam by North Korean Hackers Has ...
   2. www.motortrend.com — 2027 Hyundai Tucson First Look: Bigger, Boxier, and Bolder Than Before
   confidence 100%
2. 31d ago

   North Korea IT Worker Scheme Triggers Global Infiltration Warning

   North Korean hackers are deploying fake tech recruitment fronts and malicious coding assignments to infect over 30,000 devices worldwide. International authorities link this infrastructure directly to Pyongyang remote IT worker schemes and the WaterPlum hacking crew. Operatives target the remote employment market using artificial intelligence and stolen American identities to secure positions at U.S. companies. Five individuals recently pleaded guilty to IT worker fraud and crypto theft charges, while two Americans received federal prison sentences for operating laptop farms that masked the identities of the foreign workers.

   Why it matters

   The infiltration campaign uses third-party recruitment and remote job placements to generate hundreds of millions of dollars for North Korean weapons programs. Law enforcement agencies including the FBI and the Japan National Police Agency have exposed the global hiring scam, which ties covert IT deployments to broader cryptocurrency attacks by the Lazarus Group. Authorities warn that routine developer tasks like video conferencing fixes and coding assessments can expose corporate networks.

   What is confirmed

   • North Korean hackers posed as recruiters and infected 30,000 devices worldwide.
   • Five individuals pleaded guilty for roles in North Korea IT worker fraud and crypto theft schemes.
   • Matthew Knoot and Erick Prince received 18-month federal sentences for running laptop farms.
   • A seven-agency advisory ties the WaterPlum hacking crew and Pyongyang remote IT worker scheme to the same bureau.
   • North Korean operatives exploit artificial intelligence to secure United States jobs.

   Still unconfirmed

   • Pyongyang-backed hackers siphon over $10 million in cryptocurrency by targeting developers worldwide.

   What to watch next

   • Additional sentencings or guilty pleas in ongoing Department of Justice prosecutions related to laptop farms.
   • Further international law enforcement advisories detailing the WaterPlum hacking crew operations.
   Sources used for this update (8)

   1. www.thestar.com.my — North Korean hackers posed as recruiters. They infected 30,000 devices worldwide
   2. dailysecurityreview.com — U.S. DOJ Secures Guilty Pleas in North Korea IT Worker and ...
   3. www.yahoo.com — North Korea's Fake Job Interviews Drained $11M From 7,000 ...
   4. dailysecurityreview.com — Two Americans Jailed for Running North Korean IT Worker ...
   5. www.escudodigital.com — North Korean hackers pose as tech recruiters, compromising ...
   6. thearabianpost.com — North Korean operatives exploit AI to secure US jobs
   7. dailysecurityreview.com — North Korea's Covert IT Workforce Exposed: Unmasking the ...
   8. vsdaily.com — International Cyber Alliance Exposes Global Remote Hiring ...
   confidence 100%
3. 42d ago

   North Korea expands recruitment of foreign proxies to infiltrate US firms

   North Korea is broadening a covert campaign to embed IT staff within American companies by recruiting individuals in third countries to mask the operatives' identities. This strategy allows the regime to bypass corporate recruitment controls and identity verification. These operations fund weapons programs, generating up to 800 million dollars annually. The FBI notes these workers successfully target the remote IT job market, while the Lazarus Group simultaneously expands its cryptocurrency attacks.

   Why it matters

   The regime utilizes cryptocurrency to pay foreign recruits 500 dollars monthly to act as proxies. This systemic infiltration allows North Korean operatives to secure high-paying remote roles. The resulting revenue directly supports the state's military capabilities.

   What is confirmed

   • North Korea recruits foreign nationals to help fake IT operatives secure employment at U.S. companies.
   • The infiltration scheme generates up to 800 million dollars annually to fund weapons programs.
   • The FBI reports these operations evade crackdowns by targeting the remote IT jobs market.

   Still unconfirmed

   • The Lazarus Group is widening its cryptocurrency attacks.
   • Foreign recruits receive 500 dollars monthly payments via cryptocurrency.

   What to watch next

   • Evidence of new security protocols adopted by US firms to detect proxy IT applicants.
   Sources used for this update (2)

   1. www.cbsnews.com — Ross Fire 100% contained after over 3 weeks, 90,000 acres scorched and more than 150 structures destroyed
   2. www.crowdfundinsider.com — North Korea Recruits Foreign Talent to Infiltrate US Firms as Lazarus Group Widens Crypto Attacks
   confidence 80%
4. 44d ago

   North Korea pays foreign proxies to embed hackers in U.S. tech firms

   North Korea is paying foreign nationals 500 dollars monthly to help fake IT operatives secure employment at U.S. companies. These recruits act as proxies to bypass recruitment controls and identity checks. The regime uses cryptocurrency payments to manage this network of overseas workers. This infiltration scheme supports the funding of North Korean weapons programs, which generate up to 800 million dollars annually through these activities. The FBI reports that these operations have successfully evaded previous crackdowns by infiltrating the remote IT jobs market.

   Why it matters

   Western firms increasingly rely on remote hiring, creating vulnerabilities in identity verification. North Korea exploits this by using third-party intermediaries to mask the true identity of its hackers. This allows the state to steal wages and intellectual property while bypassing international sanctions.

   What is confirmed

   • North Korea pays foreign workers 500 dollars a month to help fake IT operatives get hired at U.S. companies.
   • The scheme uses overseas recruits to bypass recruitment controls and U.S. checks.
   • North Korea utilizes cryptocurrency payments to facilitate these operations.

   Still unconfirmed

   • The infiltration scheme funds weapons programs with up to 800 million dollars a year.

   What to watch next

   • Evidence of specific weapons programs funded by these IT wages.
   Sources used for this update (2)

   1. coincentral.com — North Korea Is Paying People in Africa and Iran to Help Its Hackers Get Hired at US Tech Firms
   2. www.cointribune.com — Crypto: North Korea Uses Foreign Recruits to Infiltrate U.S. Companies
   confidence 90%
5. 48d ago

   North Korea Expands Remote IT Infiltration Scheme

   North Korea is expanding its remote IT job infiltration scheme by recruiting talent and paying local operators five hundred dollars a month in countries such as Iran, Lebanon, Nigeria, South Africa, and India. These international proxies assist fake North Korean workers in bypassing U.S. checks through proxy interviews and sophisticated schemes for covert employment in Western firms. The FBI states that this scheme has successfully infiltrated the remote IT jobs market for years, evading previous crackdowns.

   Why it matters

   This illicit employment network allows North Korean workers to secure positions in U.S. companies while bypassing security barriers. The operation relies on international proxies who participate in substitute interviews to conceal the true identities of the applicants. The persistence of these covert operations highlights ongoing vulnerabilities in Western remote hiring practices.

   What is confirmed

   • North Korea is paying people five hundred dollars a month in Nigeria, South Africa, India, and Iran to help fake workers secure jobs inside U.S. companies.
   • The FBI states that the North Korean scheme has infiltrated the remote IT jobs market for years.
   • The network utilizes proxy interviews and interview substitutes to bypass U.S. checks and circumvent previous crackdowns.
   • North Korea's remote job scheme is recruiting workers in Iran, Lebanon, and other countries.

   What to watch next

   • Additional enforcement actions or advisories from the FBI regarding remote IT hiring fraud.
   • Identification of specific Western IT firms compromised by the proxy interview scheme.
   Sources used for this update (6)

   1. NBC News — Now recruiting: North Korea looks abroad for talent in its scheme to infiltrate U.S. companies
   2. asiae.co.kr — North Korea Circumvents Crackdowns with Proxy Interviews... Sophisticated Schemes for Covert Employment in Western IT Firms
   3. qz.com — North Korea's remote job scheme now recruiting workers in Iran, Lebanon, and other countries
   4. NewsNation — North Korea scheme infiltrated remote IT jobs market for years, FBI says
   5. 조선일보 — North Korea's Interview Substitutes Bypass U.S. Checks
   6. Business Insider Africa — North Korea is paying people $500 a month in Nigeria, South Africa, India and Iran to help fake workers get jobs inside US companies
   confidence 95%