North Korea Exploits Foreign Remote Workers to Infiltrate U.S. Companies

North Korea Exploits Remote Workers to Infiltrate U.S. Companies

Under international economic sanctions, North Korean operatives are not applying directly to companies' hiring processes but are instead using foreign workers from third countries as "proxy interviewers" to carry out sophisticated infiltration into U.S. companies. This alarming trend has been increasingly revealed.

North Korea has shifted from its traditional method of applying directly while concealing its nationality to a more advanced tactic involving remote technicians from third countries such as Iran and Lebanon. This shift aims to bypass strict identity checks and audits that companies impose on applicants related to North Korea.

Specifically, North Korea's network has been exploiting professional platforms like LinkedIn to scout foreign IT workers. In some cases, it has been found that these workers are offered cryptocurrency rewards worth about $500 per month (approximately ¥76,800) in exchange for working part-time as "interview assistants."

The role of the selected foreign workers is to attend remote hiring interviews and facilitate communication with employers. This allows individuals with legitimate backgrounds and identities to pass the hiring process. However, once an employment contract is signed, the actual access to the company's network and the day-to-day operations or development tasks are handed over to the North Korean operatives lurking behind the scenes.

Risks as Internal Threats and Targeting of Cryptocurrencies

From the employer's perspective, the assumption that the person who conducted the interview is the same as the one who later operates the confidential network is shattered, making it extremely difficult to detect fraud. Joint warnings issued by the U.S. government and several foreign agencies point out that these disguised remote workers are not merely a means of evading sanctions but pose a serious internal threat.

The main risks include the following advanced fraudulent activities:

**- Leakage of corporate data or attempts to steal confidential information

• Maintenance of unauthorized access to corporate systems
• Large-scale theft of digital assets and cryptocurrencies**

This threat is particularly fatal for companies dealing with cryptocurrencies and cutting-edge technologies. According to analysis by cybersecurity firm CrowdStrike, losses of cryptocurrencies caused by North Korean government-linked hackers and threat actors are expected to exceed $2 billion (approximately ¥307.53 billion) by 2025, marking a 51% increase year-on-year. Unlike traditional hacking that exploits vulnerabilities, this method is particularly difficult to detect for defenders as it acquires access rights through legitimate hiring processes, effectively entering through the "front door."

Financial Motivations Behind North Korea's Cyber Operations and Future Corporate Defense Strategies

The financial motivations behind these cyber operations aimed at acquiring foreign currency and evading sanctions are extremely powerful.

Despite ongoing international isolation and strict sanctions, estimates from the Bank of Korea predict that North Korea's GDP growth rate will reach 3.5% by 2025. This suggests that illicit technical employment abroad and the theft of cryptocurrencies are functioning as effective sources of funding for the national economy.

To counter these increasingly sophisticated cyber operations, companies relying on remote hiring and those related to cryptocurrencies are being compelled to fundamentally reassess their security systems. Verification of identity at the time of hiring is no longer sufficient; there is an urgent need to establish a robust management system that continuously monitors whether the person currently operating the system is the same individual who passed the interview throughout the entire employment period. As attackers' tactics become more sophisticated, corporate security awareness and governance against threats targeting the hiring process itself are being put to the test.