North Korea Uses Iranian, Lebanese IT Workers to Infiltrate US Companies

North Korea is stepping up efforts to infiltrate US companies by using IT workers in third countries such as Iran and Lebanon, according to a report.

Cointelegraph, a cryptocurrency-focused media outlet, reported on September 12 that NBC had said North Korea was placing remote workers from third countries in US companies and using the proceeds to fund weapons development.

A joint advisory issued in July by the US government and several foreign agencies said North Korean IT workers seek to obtain contract jobs and funnel their wages to senior North Korean entities. It added that they pose insider threats tied to data leaks, cryptocurrency theft and the theft of sensitive information.

NBC reported that North Korea shifted tactics as the US and other governments intensified their response. It has used third-country IT workers as stand-ins for job interviews. Those foreign IT workers, recruited through LinkedIn, were paid cryptocurrency worth about $500 a month for serving as interview proxies. Once a contract is secured, North Korean operatives take over the actual work.

Cointelegraph also reported in May, citing cybersecurity firm CrowdStrike, that North Korean state-linked hacking groups caused more than $2 billion in cryptocurrency-related losses in 2025. That was a 51% increase from a year earlier.

The Bank of Korea estimated that North Korea's gross domestic product grew 3.5% in 2025 despite international sanctions.