logo

North Korea IT worker scheme swells beyond US companies

ID: e23c52b5-b773-58f3-a2e8-523cb05d3b90

STIX ID: report--e23c52b5-b773-58f3-a2e8-523cb05d3b90

Feed Name: CyberScoop

Threat Score
85/100

Date Published: 2025-10-02

Date Updated: 2026-04-21

Author: Matt Kapko

...
...

Okta threat researchers report that North Korean-aligned operators have used fabricated identities to infiltrate thousands of companies as remote employees and contractors across IT, finance and many other sectors, conducting over 6,500 job interviews via more than 130 personas; the operation has expanded globally (≈27% of roles outside the U.S.) and is used to collect and launder payments, prompting indictments, sanctions, and cryptocurrency seizures.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.