How North Korean IT Workers Infiltrated Global Businesses: 2025 Insider Threat Surge

Between 2021 and mid-2025, North Korean nationals covertly infiltrated thousands of businesses worldwide by posing as legitimate remote IT and finance workers. According to Okta and other cyber threat intelligence sources, over 130 unique identities were linked to North Korean operatives who participated in more than 6,500 job interviews across roughly 5,000 companies, affecting industries from technology and finance to healthcare and manufacturing. The scheme enabled the North Korean regime to launder payments in violation of international sanctions, while threat actors refined methods to evade common screening controls and exploit global hiring pipelines. High volumes of applications, especially in remote roles, allowed these operatives to bypass national and enterprise-level defenses, embedding deeper into victim organizations’ critical workflows and data environments.

The global expansion and sophistication of North Korea’s IT worker operation underscore a dangerous evolution in cyber-enabled insider threats and economic espionage. With a 220% increase in detected North Korean IT worker activity year-over-year, businesses worldwide now face heightened risk regardless of geography or sector, making identity vetting and remote work controls a top security priority.

This incident highlights a rapidly expanding and highly organized campaign by North Korean operatives to exploit global remote workforces. As hiring processes become more reliant on digital screening and remote collaboration, companies outside the U.S. are increasingly vulnerable, often lacking experience detecting sophisticated insider threats from sanctioned states. Immediate attention is needed to tighten background checks and enhance anomaly detection controls.