North Korea Circumvents Crackdowns with Proxy Interviews... Sophisticated Schemes for Covert Employment in Western IT Firms

Recruiting Third-Country Nationals to Pass Interviews
Attempting to Bypass AI Identity Verification

According to foreign media reports, North Korea has been evading intensive crackdowns by using foreign nationals as stand-ins for job interviews, as part of its scheme to covertly place information technology (IT) personnel in Western companies.

Yonhap News Agency

On September 11 (local time), NBC News in the United States reported that U.S. authorities and cybersecurity experts believe North Korea's methods for IT job placement under false pretenses are becoming increasingly sophisticated.

North Korea's new tactics involve employing third-country nationals from countries such as Iran, Syria, Lebanon, and South Africa to pose as job applicants and participate in video interviews on their behalf. Once the proxy interview is successful and the hire is finalized, the actual work is handed over to North Korean IT personnel. In some cases, the stand-in interviewees even take tests or meet directly with company representatives.

According to cybersecurity firm Flare, since 2024, at least 14 Iranians have been recruited as proxy interviewees for North Korean IT teams. Among them, at least two passed U.S. companies' hiring processes on behalf of North Korean applicants and even received official job offers.

The reason behind North Korea's use of foreign nationals as stand-in interviewees lies in strengthened identity verification procedures by Western companies. Previously, North Koreans attempted to pass video interviews by disguising their identities with artificial intelligence (AI) filters. However, as companies have toughened screening measures—such as demanding specific gestures or requiring denouncement of North Korean leader Kim Jong Un to detect AI filter usage—North Korea has shifted to using actual foreign nationals to circumvent these checks.

Cybersecurity firm Kudelski Security has also confirmed the existence of developers from Iran, Syria, and South Africa who responded to North Korean proposals this year and participated in proxy interviews or tests. It has been reported that North Korea offered some Iranian proxies a monthly fee of $500 (approximately 670,000 won) for conducting these interviews.

Instances where North Korea outsources not just job interviews but the actual work itself to foreign engineers have also increased. This is believed to be due to the expanded scale of North Korea's covert employment operations, making it difficult to manage the workload with its own personnel alone.

According to DTEX, a security firm tracking North Korean cybercrime, North Korea is also attempting to recruit collaborators from Nigeria, Pakistan, India, and some regions in Central and South America. U.S. authorities estimate that thousands of North Korean IT personnel have been mobilized in these covert employment schemes. A sanctions monitoring report led by the U.S. State Department estimates that North Korea earned up to $800 million (approximately 1.08 trillion won) through such activities in 2024.

This content was produced with the assistance of AI translation services.