North Korea's IT Worker Scheme Fuels Russian Military Operations

A report by DTEX reveals that North Korea's IT worker scheme is channeling funds through a network of front companies and sanctioned entities to support Russia's war effort in Ukraine. This operation extends beyond merely funding North Korea's weapons programs, impacting various state objectives. Between December 2025 and February 2026, $1.97 million was traced through Korea Ryonbong General Corp, a sanctioned defense entity. The scheme involves 390 IT worker accounts and utilizes an internal payment server controlled by a single administrator. The funds are not only directed towards military supplies for Russia but also support domestic programs within North Korea. This financial network is characterized as a bottom-up model, where revenue generated by lower-level workers is funneled upwards to support broader state activities. The report emphasizes the overlooked consequences of this scheme, highlighting its extensive reach and implications for international security.

Key Points: • North Korea's IT worker scheme is funding Russia's military operations in Ukraine. • Over $1.97 million was traced through sanctioned entities to support various state objectives. • The scheme operates on a bottom-up revenue model, impacting multiple domestic programs.