North Korea Expands Recruitment Scheme for Cyber Operations
Article Content
- •North Korea recruits foreign workers to disguise identities in job applications.
- •The scheme generates hundreds of millions annually for North Korea's weapons programs.
- •Countries targeted for recruitment include Iran, Nigeria, South Africa, and India.
North Korea is expanding its recruitment of foreign workers to infiltrate U.S. companies, utilizing individuals from countries like Iran, Nigeria, South Africa, and India. These foreign recruits are paid approximately $500 a month to act as 'interview associates' and help North Korean operatives secure remote technology jobs under false identities. This scheme generates significant revenue for the North Korean regime, estimated to be between $600 million to $800 million annually, which is funneled into sanctioned programs, including weapons development. U.S. officials and cybersecurity researchers have noted that this operation has become increasingly sophisticated, with North Korean teams employing foreign nationals to obscure their identities during job applications. The United Nations has also highlighted the scale of these operations, indicating that North Korea's cyber activities yield at least $1 billion each year.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (23)
Continue Reading
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…