< Back to all clusters
[TECHNOLOGY] · North Korea, Iran, South Africa, Nigeria, India · 3 sources

started · updated

North Korea uses third-country proxies to bypass IT job interviews

North Korean cyber teams are employing a sophisticated new tactic to infiltrate foreign companies by using third-country nationals to act as proxy interviewers. According to US officials and cybersecurity researchers, these facilitators—located in countries such as Iran, South Africa, Nigeria, Lebanon, and India—participate in video interviews and coding tests to bypass increasingly strict verification processes used by Western firms.

Once a contract is secured, the actual technical work is handed over to North Korean operatives. This method is designed to evade detection methods like AI deepfake filters and specific behavioral verification questions. Security firms like Flare and DTEX report that North Korean teams have been scouting potential associates on platforms like LinkedIn, offering monthly payments of approximately $500 in cryptocurrency.

The financial implications are significant. A US-led sanctions monitoring assessment estimated that North Korea earned up to $800 million through these disguised IT employment schemes in 2024. These funds are believed to be used to finance sanctioned programs, including weapons development. The operation poses a multi-faceted threat, including potential data exfiltration, cryptocurrency theft, and insider threats to the companies involved.

Entities

DTEX · Flare · LinkedIn · North Korea · U.S. Department of State · United States

Claims

What the coverage asserts, and how many sources carry each claim.