North Korea recruits foreign proxies to secure IT jobs at US companies

North Korea is reportedly expanding its remote IT-worker operations by recruiting foreign nationals to impersonate job applicants during video interviews before North Korean operators take over the positions.

According to International Business Times UK, citing a July 31 joint government alert and research by cybersecurity firm Flare, third-country recruits can present credible identities during interviews, helping North Korean workers evade increasingly strict hiring checks.

Some recruits were allegedly approached through LinkedIn and paid in cryptocurrency, with one arrangement offering about $500 monthly for part-time interview work. Flare said it found evidence that at least 14 Iranian nationals entered recruitment pipelines linked to the scheme, with at least two receiving formal offers from US employers.

Authorities say the operation goes beyond employment fraud because earnings are channelled to North Korean organisations and can help finance Pyongyang’s nuclear weapons and ballistic missile programmes. Workers may also gain access to corporate networks, sensitive information and cryptocurrency.

The report said North Korea has previously relied on stolen identities, fraudulent websites, proxy computers and US-based facilitators to secure remote jobs.

In April, two US nationals were sentenced for helping North Korean IT workers obtain positions at more than 100 American companies using at least 80 stolen identities, generating over $5 million.

Governments including the US, UK, Australia, Japan and South Korea have urged companies to strengthen identity checks, scrutinise documents and conduct in-person interviews where possible to counter the expanding threat.

US authorities have also linked operations to data theft and extortion, warning employers that unknowingly hiring such workers can create cybersecurity and compliance risks.