Skip to content

North Korea

Isolated East Asian state whose authoritarian government runs state-sponsored cyber operations, including hacking and crypto theft, to fund itself.

Known aliases

  • DPRK
  • Pyongyang
  • the North

Current stories

securityOne report1 publisher

North Korean IT workers pay Americans to appear on camera and keep work laptops online

FBI says North Korean IT workers increasingly depend on witting and unwitting Americans to win jobs at U.S. companies. The bureau says no single indicator catches them, so employers have to weigh several signals together.

Publishers:ic3.gov

Reality

Evidence50
Adoption
Not scored
Hype gap
Not scored
Incentives
Not scored
Confidence55
investConfirmed2 publishers

North Korea's Oct. 12 launch follows Seoul's Oct. 8 disclosure of a glide-vehicle test by four days and its own claimed 1,000 km missile launch by nine

North Korea launched toward the East Sea on Oct. 12, nine days after its Oct. 3 test, South Korea's Joint Chiefs of Staff said. Seoul was still analyzing the projectiles, so a case for pricing lasting Korea and Japan risk rests on frequency alone for now.

Publishers:en.sedaily.com scmp.com

Reality

Evidence60
Adoption
Not scored
Hype gap+20
Incentives55
Confidence58
investConfirmed3 publishers

Seoul recalls ambassador Park Ki-chang from Kyiv over a POW apology it says falls short

South Korea is recalling its ambassador to Ukraine over Volodymyr Zelensky's disclosure that North Korean prisoners of war were sent to Seoul. A report cited by SCMP, of more than 176,000 tonnes of fuel shipped from South Korea to Russia, becomes a problem for Korean refiners only once its sellers are named.

Perspective Coverage

3 publishers
Builder
Builder 5%
Operator
Operator 67%
Investor
Investor 28%

Reality

Evidence72
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence70
securityOne report1 publisher

North Korea moves its fraudulent-hire scheme into sales, marketing and medical roles

Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.

Reality

Evidence50
Adoption
Not scored
Hype gap+20
Incentives
Not scored
Confidence50
leadershipOne report1 publisher

FBI says North Korean IT workers are ransoming stolen code once employers spot them

An updated bureau alert describes hired developers copying repositories into personal cloud accounts and then demanding payment once they are found. Seven of its eleven recommendations still sit at the hiring gate.

Publishers:fbi.gov

Reality

Evidence62
Adoption
Not scored
Hype gap+10
Incentives30
Confidence58
securityOne report1 publisher

Argentina and Pakistan open cases against the local handlers in North Korea's IT worker scheme

The MSMT says Vietnam, Laos, Pakistan and Argentina had all acted on last October's UN findings by July. The named targets are an alleged money launderer in Argentina and an alleged document forger in Pakistan.

Publishers:therecord.media

Reality

Evidence55
Adoption30
Hype gap+12
Incentives62
Confidence55
securityOne report1 publisher

Sekoia and Kudelski split the Lazarus umbrella into six DPRK sub-clusters

The joint research argues that constant reorganization under the GRIB and NIA is a control mechanism rather than administrative noise, and that treating Lazarus as one actor hides the revenue mandate driving most of the intrusions.

Publishers:kudelskisecurity.com

Reality

Evidence38
Adoption
Not scored
Hype gap+18
Incentives62
Confidence48
productOne report1 publisher

Unit 42 clocked data leaving inside the first hour in nearly a fifth of its 2024 cases

The 500-plus engagements behind that share are all companies that already needed an outside responder, so the figure describes how fast a bad day closes rather than your odds of having one. It still decides which of your controls can fire in time.

Publishers:paloaltonetworks.com

Reality

Evidence58
Adoption
Not scored
Hype gap+30
Incentives80
Confidence60
securityOne report1 publisher

Huntress confirms five DPRK-aligned workers cleared hiring and onboarding in 2026

Recruiting and document review own this intrusion path, because the hire really does the job. Huntress found its five 2026 cases in passport photo metadata and in a PiKVM turning up on a new starter's laptop.

Reality

Evidence55
Adoption35
Hype gap+15
Incentives70
Confidence55
investOne report1 publisher

North Korea's 2015 shock cost 1.1% of output and a distribution that did not come back

A Bank of Korea paper built on defector surveys finds market-income inequality widened after the 2014-2015 drought and power crunch, driven by the bottom of the distribution, and stayed wide.

Publishers:en.sedaily.com

Reality

Evidence42
Adoption
Not scored
Hype gap+12
Incentives34
Confidence40
investOne report1 publisher

Seoul's first read on a second North Korean deployment: preparation yes, movement no

Ukraine's military intelligence floats a request for up to 50,000 more troops. South Korea's Defense Intelligence Agency reports internal preparation and no working-level signs. The gap is the useful number.

Publishers:en.sedaily.com

Reality

Evidence52
Adoption
Not scored
Hype gap+38
Incentives64
Confidence48
investOne report1 publisher

Seoul's freeze-first turn, and the 30 warheads it would leave on the table

South Korea's unification ministry now lists a nuclear freeze alongside phased denuclearization, and US Pacific Command declined to condemn the North's latest ballistic launches.

Publishers:en.sedaily.com

Reality

Evidence44
Adoption21
Hype gap+14
Incentives56
Confidence41
leadershipOne report1 publisher

China's $1 Trillion Illicit Economy Runs On Rails Your Supply Chain Already Uses

Foreign Affairs puts the annual take near $1 trillion and says two-thirds of counterfeit seizures worldwide trace to China or Hong Kong. That is a counterparty problem, not a compliance checkbox.

Reality

Evidence44
Adoption58
Hype gap+24
Incentives34
Confidence46
leadershipOne report1 publisher

Trump cut Korea drills before talks exist. Price alliance reliability, not just Pyongyang.

The order to "substantially reduce" US-South Korea exercises came with no meeting scheduled and no public reply from Pyongyang. That makes it a planning input, not a headline.

Publishers:vox.com

Reality

Evidence58
Adoption34
Hype gap+16
Incentives68
Confidence54
securityOne report1 publisher

North Korea's hiring funnel: 60 applications a day, 22 personas, ten jobs landed

Recorded Future says one PurpleDelta cluster applied at more than 1,100 companies and was likely employed at ten or more. The control point is the recruiting funnel, not the SOC.

Reality

Evidence64
Adoption55
Hype gap+12
Incentives72
Confidence56
securityOne report1 publisher

A North Korean IT worker got hired by a federal agency. Vetting is a security control now.

The FBI is investigating how the hire happened, and SecurityWeek reports it was probably a contract job. The same roundup carried Rapid7 cutting 314 jobs under a new CEO.

Publishers:securityweek.com

Reality

Evidence38
Adoption42
Hype gap+22
Incentives55
Confidence36