Are You A Freelancer? North Korean Spies May Be Using You 2025

North Korea is recruiting freelancers as identity proxies to score remote contracts and bank accounts, according to new cyber intelligence research.

North Korea’s IT operatives are shifting strategies and recruiting freelancers to provide proxy identities for remote jobs.

Operatives are contacting job seekers on Upwork, Freelancer and GitHub before moving conversations to Telegram or Discord, where they coach them through setting up remote access software and passing identity verifications.

In earlier cases, North Korean workers scored remote gigs using fabricated IDs. According to Heiner García, a cyber threat intelligence expert at Telefónica and a blockchain security researcher, operatives are now avoiding those barriers by working through verified users who hand over remote access to their computers.

The real owners of the identities receive only a fifth of the pay, while the rest of the funds are redirected to the operatives through cryptocurrencies or even traditional bank accounts. By relying on real identities and local internet connections, the operatives can bypass systems designed to flag high-risk geographies and VPNs.

Earlier this year, García set up a dummy crypto company and, together with Cointelegraph, interviewed a suspected North Korean operative seeking a remote tech role. The candidate claimed to be Japanese, then abruptly ended the call when asked to introduce himself in Japanese.

García continued the conversation in private messages. The suspected operative asked him to buy a computer and provide remote access.

The request aligned with patterns García would later encounter. Evidence linked to suspicious profiles included onboarding presentations, recruitment scripts and identity documents “reused again and again.”

Related: North Korean spy slips up, reveals ties in fake job interview

The people handing over their computers “are victims,” he added. “They are not aware. They think they are joining a normal subcontracting arrangement.”

Source: CoinTelegraph