Reports have revealed that North Korean IT workers are having talent from third countries participate in proxy interviews, making their fraudulent employment at US companies increasingly multinational. Multiple investigations have shed light on the mobilization of talent from Iran and Syria, among other countries, and on the structure of the operation.
According to an NBC News report dated 11 September 2026, the North Korean IT worker scheme is expanding to incorporate remote workers from third countries, with third-country talent participating in interviews and in-person interactions. In addition to conventional methods of concealment, cases have been identified in which real individuals from third countries conduct interviews using fake Western personas.
An investigation by Kudelski Security found that developers in Iran, Syria and South Africa were recruited through LinkedIn and then moved to WhatsApp. It also showed that roles such as Caller, Local person and Developer had been structured into a division of responsibilities. Job interviews proceed with the participation of real individuals, and in some cases another North Korean worker is said to perform the actual work after the candidate is hired.
Flare says it identified at least 14 Iranian nationals, at least 2 of whom had received formal job offers from US companies. The compensation paid to third-country talent ranged from approximately $500 per month initially as an “Interview Associate” to approximately $2,700 per month after employment. Cases involving payment in cryptocurrency were also identified.
Revenue from the North Korean IT worker scheme in 2024 was reportedly approximately $800 million, and the scheme is subject to sanctions by the US Treasury Department. The Japanese government also warned on 31 July of that year about the increasing use of third-party proxies, and pointed to the need for rigorous identity verification not only during online interviews but also when individuals are deployed for actual work.