North Korea has expanded its covert strategy to infiltrate U.S. companies by recruiting remote workers from other countries, including Iran and Lebanon, to help disguise its activities. According to U.S. government agencies and cybersecurity experts, this scheme involves thousands of individuals applying to American companies, generating hundreds of millions of dollars annually. This money is then used to fund North Korea’s illicit weapons programs, including its nuclear and missile development. The U.S. State Department and the Department of Justice issued a joint warning in July, noting that North Korea is using increasingly sophisticated tactics, such as recruiting people from other countries to help obscure their identities and operate globally. North Korean teams have started to use individuals in countries like Iran, Syria, Lebanon, South Africa, and Saudi Arabia to conduct on-camera interviews with Western companies. This is a new development from earlier methods, where North Korea relied on U.S.-based facilitators to run company laptops and provide local internet access. According to a report by Flare, a cyber threat intelligence company, at least 14 Iranians have been directly recruited by North Korean IT teams since 2024. Some of these individuals received formal job offers from U.S. employers after completing interview processes on behalf of North Korean teams. These recruits were sometimes paid in cryptocurrency and coached to use false identities to avoid detection. North Korea’s remote work schemes have grown significantly since the pandemic, allowing workers to access U.S. companies and funnel money back to the regime. These salaries are used to evade international sanctions and support the regime’s illicit programs, including its weapons of mass destruction and ballistic missile efforts. The United Nations estimates the schemes generate up to $600 million annually, while the U.S. State Department estimates as high as $800 million in 2024. In response, Western companies have taken steps to detect fraud, such as asking candidates to perform specific actions to check for AI filters or express negative opinions about North Korean leader Kim Jong Un. However, using people from other countries to conduct interviews helps North Korea bypass these checks. In addition to on-camera interviews, North Korean teams are subcontracting parts of the interview process to developers in countries like Iran, Syria, and South Africa. These individuals, often identified on LinkedIn, are sometimes asked to assist in passing technical tests. According to security firm DTEX, North Korea is also targeting developers in Nigeria, Pakistan, India, and parts of Latin America to help expand the scheme. In response to a July government alert about the expansion of these IT schemes, North Korea’s Foreign Ministry denied the claims, calling the advisory a politically motivated attempt to damage its reputation. Despite global sanctions, North Korea’s economy has shown growth, with the Bank of Korea estimating a 3.5% increase in real GDP in 2025. Cybercrime earnings, including IT salaries and cryptocurrency thefts, are believed to contribute significantly to this growth.