started · updated
North Korea uses third-country proxies to bypass IT job interviews
North Korean cyber teams are employing a sophisticated new tactic to infiltrate foreign companies by using third-country nationals to act as proxy interviewers. According to US officials and cybersecurity researchers, these facilitators—located in countries such as Iran, South Africa, Nigeria, Lebanon, and India—participate in video interviews and coding tests to bypass increasingly strict verification processes used by Western firms.
Once a contract is secured, the actual technical work is handed over to North Korean operatives. This method is designed to evade detection methods like AI deepfake filters and specific behavioral verification questions. Security firms like Flare and DTEX report that North Korean teams have been scouting potential associates on platforms like LinkedIn, offering monthly payments of approximately $500 in cryptocurrency.
The financial implications are significant. A US-led sanctions monitoring assessment estimated that North Korea earned up to $800 million through these disguised IT employment schemes in 2024. These funds are believed to be used to finance sanctioned programs, including weapons development. The operation poses a multi-faceted threat, including potential data exfiltration, cryptocurrency theft, and insider threats to the companies involved.
Entities
DTEX · Flare · LinkedIn · North Korea · U.S. Department of State · United States
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] North Korea earned an estimated $800 million through disguised IT employment in 2024. www.kyeonggi.com · africa.businessinsider.com
- [● 2 SOURCES] North Korean teams are attempting to recruit facilitators in Nigeria, Pakistan, India, and parts of Latin America. www.kyeonggi.com · africa.businessinsider.com
- [○ 1 SOURCE] At least 14 Iranians have been recruited as proxy interviewers for North Korean teams since 2024. www.kyeonggi.com
- [● 3 SOURCES] North Korean operatives offer third-country facilitators approximately $500 per month in cryptocurrency to act as interview associates. www.kyeonggi.com · bitcoinethereumnews.com · africa.businessinsider.com
- [● 3 SOURCES] North Korean IT workers are using individuals in third countries to participate in job interviews and secure remote technology roles under false identities. www.kyeonggi.com · bitcoinethereumnews.com · africa.businessinsider.com