logo

North Korea's IT Worker Scheme Fuels Russian Military Operations

ID: 011e8d6a-d1f5-5ee0-b195-a95c6fc60587

STIX ID: report--011e8d6a-d1f5-5ee0-b195-a95c6fc60587

Feed Name: ThreatCluster

Threat Score
70/100

Date Published: 2026-07-21

Date Updated: 2026-07-22

...
...

A DTEX report reveals North Korea operates an IT worker scheme that channels funds through front companies and sanctioned entities—tracing $1.97M via Korea Ryonbong General Corp—using 390 IT worker accounts and an internal payment server controlled by a single administrator to finance Russian military supplies and domestic state programs; the network follows a bottom-up revenue model with broad implications for international security.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.