DPRK IT Workers Impersonate Professionals On LinkedIn To Secure Remote Jobs

Back Cyberpress

DPRK IT Workers Impersonate Professionals On LinkedIn To Secure Remote Jobs

Cyberpress • February 10, 2026

Share: View original

Cybersecurity firms like Mandiant and Recorded Future have tracked this trend since 2023, with a sharp rise in 2025. These operatives target high ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DPRK Operatives Use LinkedIn to Target Remote IT Positions North Korean operatives are impersonating professionals on LinkedIn to apply for remote IT roles, utilizing real accounts to enhance their credibility. This strategy aims to infiltrate global organizations and generate revenue for the regime, marking a shift from previous tactics that relied on fabricated identities. 4 sources 38

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

T1566 - Phishing