Home ScienceNorth Korea's 100,000-strong fake IT worker army r...
Science⭐ Featured

North Korea's 100,000-strong fake IT worker army rake in $500M a year for Kim Jong Un

Researchers map full org chart of the scam from dodgy recruiters to helpful Western collaborators Researchers at IBM X‑Force and Flare Research have uncovered data that sheds light on how North Korea's fake IT worker schemes operate and infiltrate companies in order to funnel money back to the regime and steal sensitive information.…

7 April 2026 at 08:09 am
1 views
North Korea's 100,000-strong fake IT worker army rake in $500M a year for Kim Jong Un

North Korea's 100,000-strong fake IT worker army rake in $500M a year for Kim Jong Un

In a shocking revelation, researchers from IBM X-Force and Flare Research have uncovered the intricate structure of North Korea's elaborate scheme to infiltrate global companies with a 100,000-strong army of fake IT workers. This operation, which is estimated to generate over $500 million annually for Kim Jong Un's regime, not only funnels money back to the isolated nation but also enables the theft of sensitive information.

The scam, which has been operating for years, involves a complex network of recruiters, intermediaries, and even some unsuspecting Western collaborators. Researchers have meticulously mapped out the entire operation, revealing how it operates and how it infiltrates companies to achieve its goals.

The scheme begins with North Korean recruiters targeting individuals in neighboring countries such as China and Vietnam. These recruiters often pose as legitimate employers, offering attractive job opportunities in the IT sector. They typically target individuals who are in dire need of work or those who are unaware of the true nature of the job offers. Once recruited, these workers are often subjected to harsh training and indoctrination, with the ultimate goal of infiltrating foreign companies.

After undergoing training, the fake IT workers are dispatched to various countries, including Europe and Asia. They are tasked with finding employment in companies that have access to sensitive information or financial resources. Once employed, these workers are instructed to leak information, steal proprietary data, or even engage in cyber espionage. In some cases, they are also tasked with funneling funds back to North Korea through complex financial networks.

The operation's success is partly due to its ability to exploit gaps in international security and employment practices. Many companies, in their quest for skilled workers, overlook the due diligence process, making it easier for North Korean operatives to infiltrate their ranks. Additionally, the fake workers often blend in seamlessly, as they are well-trained in their roles and can speak multiple languages.

Western collaborators play a crucial role in this scheme. Some individuals and companies, often unknowingly, assist in the recruitment or placement of these fake workers. This could involve providing false job references, facilitating visas, or even offering training programs. While not all collaborators are aware of the true purpose of their involvement, their actions inadvertently support the regime's illicit activities.

The scale of this operation is staggering. With an army of 100,000 fake IT workers, North Korea is able to generate significant revenue for its regime. This money is used to fund various programs, including nuclear weapons development and the regime's overall infrastructure. Moreover, the stolen information provides North Korea with valuable insights into global technological advancements and political strategies.

The revelation of this operation has raised concerns about the vulnerabilities in global supply chains and the need for enhanced security measures. Governments and companies around the world must be vigilant and implement robust due diligence processes to prevent such infiltration. Additionally, international cooperation is essential to dismantle these complex networks and hold those responsible accountable.

In conclusion, North Korea's fake IT worker army is a sophisticated and profitable operation that has been successfully infiltrating global companies for years. The revelation of its structure and extent highlights the need for increased vigilance and collaboration to combat such threats. As the world becomes more interconnected, the potential for such schemes to evolve and adapt grows, posing a significant challenge to global security.

📰 Related News
The largest orbital compute cluster is open for business | TechCrunch
The largest orbital compute cluster is open for business | TechCrunch
Kepler Communications is flying 40 GPUs in Earth orbit. And its latest customer is Sophia Space.
14 Apr
‘Mideast conflict poses risks to Philippines growth’
‘Mideast conflict poses risks to Philippines growth’
The Philippine economy is expected to grow at a faster pace of 5.3 percent this year from last year’s 4.4 percent but the ongoing Middle East conflict is seen to pose risks, according to the Association of Southeast Asian Nations Plus 3 Macroeconomic Research Office.
7 Apr
AFBI welcomes DUP representatives to its research farm at Hillsborough
AFBI welcomes DUP representatives to its research farm at Hillsborough
The Agri-Food and Biosciences Institute (AFBI) welcomed a number of DUP representatives to its research farm at Hillsborough on Friday.
7 Apr
A simple way to get more value from metrics
A simple way to get more value from metrics
We spent one day 1 building a system that immediately found a mid 7 figure optimization (which ended up shipping). In the first year, we shipped mid 8 figures per year worth of cost savings as a result. The key feature this system introduces is the ability to query metrics data across all hosts and all services and over any period of time (since inception), so we've called it LongTermMetrics (LTM) internally since I like boring, descriptive, names. This got started when I was looking for a starter project that would both help me understand the Twitter infra stack and also have some easily quantifiable value. Andy Wilcox suggested looking at JVM survivor space utilization for some large services. If you're not familiar with what survivor space is, you can think of it as a configurable, fixed-size buffer, in the JVM (at least if you use the GC algorithm that's default at Twitter). At the time, if you looked at a random large services, you'd usually find that either: The buffer was too small, resulting in poor performance, sometimes catastrophically poor when under high load. The buffer was too large, resulting in wasted memory, i.e., wasted money. But instead of looking at random services, there's no fundamental reason that we shouldn't be able to query all services and get a list of which services have room for improvement in their configuration, sorted by performance degradation or cost savings. And if we write that query for JVM survivor space, this also
7 Apr
Accelerating Mathematical and Scientific Discovery with Gemini Deep Think
Accelerating Mathematical and Scientific Discovery with Gemini Deep Think
Research papers point to the growing impact of Deep Think across fields
7 Apr
Gemini 3 Deep Think: Advancing science, research and engineering
Gemini 3 Deep Think: Advancing science, research and engineering
Our most specialized reasoning mode is now updated to solve modern science, research and engineering challenges.
7 Apr
Context Engineering for Coding Agents
Context Engineering for Coding Agents
The number of options we have to configure and enrich a coding agent’s context has exploded over the past few months. Claude Code is leading the charge with innovations in this space, but other coding assistants are quickly following suit. Powerful context engineering is becoming a huge part of the developer experience of these tools. Birgitta Böckeler explains the current state of context configuration features, using Claude Code as an example. more…
7 Apr
What does less protein and nitrogen mean for methane?
What does less protein and nitrogen mean for methane?
Does feeding less protein to cows over a longer period not only reduce nitrogen losses, but also affect methane emissions? Researchers at Wageningen University & Research (WUR) investigated this in a multi-year study with dairy cows, funded by the Vereniging Diervoederonderzoek Nederland (VDN), the Dutch Ministry of Agriculture, Fisheries, Food Security and Nature (LVVN), and […] The post What does less protein and nitrogen mean for methane? appeared first on Agriland.ie .
7 Apr
Second’s Bark Boasts New era of Bitcoin Payments, drawing in former Blockstream developers
Second’s Bark Boasts New era of Bitcoin Payments, drawing in former Blockstream developers
Bitcoin Magazine Second’s Bark Boasts New era of Bitcoin Payments, drawing in former Blockstream developers Second, the Bitcoin development lab founded by ex-Blockstream executives including CEO Steven Roose and CTO Erik De Smedt, has unveiled Bark — its custom Ark protocol implementation promising self-custodial payments that are faster and cheaper than Lightning channels. This post Second’s Bark Boasts New era of Bitcoin Payments, drawing in former Blockstream developers first appeared on Bitcoin Magazine and is written by Juan Galt .
7 Apr
'Morale boost': Nasa carries out Moon mission during tough year for science
'Morale boost': Nasa carries out Moon mission during tough year for science
HOUSTON — As the four Artemis astronauts approached a high point of their lunar mission -- getting slung around the far side of the Moon -- National Aeronautics and Space Administration (Nasa) staffers crowded into Houston's famed mission control room Monday for a team photo.
7 Apr