North Korea's scheme to deploy IT workers globally is funneling money through a complex network of front companies and sanctioned entities, which in turn partially funds Russia's war in Ukraine, according to a new report. This operation has expanded beyond solely supporting the country's weapons programs to encompass a broader range of the regime's objectives, as reported by CyberScoop.
Security firm DTEX's research reveals that the illicit IT worker scheme is a significant revenue stream for North Korea, with funds being channeled through organizations like Sobaeksu, Saenal, and Songkwang. Notably, $1.97 million in payments between December 2025 and February 2026 flowed directly through Korea Ryonbong General Corp, a sanctioned defense entity. This revenue supports not only weapons manufacturing and supply to Russia's military but also various domestic programs.
Previously leaked data, including chat logs and transaction data from a North Korean payment server, corroborates these findings. The scheme operates on a bottom-up model, where individuals at the lower levels generate revenue, with a portion being siphoned upwards to fund a wider array of state activities and sanctioned entities, including Russia's ongoing military operations.
Source: CyberScoop
