North Korea’s IT workers infiltrating U.S. firms through Chinese shell companies

Strider Technologies, a U.S. cyber intelligence platform, said in a newly released report that it had identified 35 China-based firms connected to North Korean IT operations.

These firms appear to be linked to Liaoning China Trade Industry, which has been previously sanctioned by the U.S. for exporting IT equipment to North Korean government agencies, according to the report.

On Jan. 16, the U.S. Treasury Department’s Office of Foreign Assets Control placed Liaoning China Trade Industry on its sanctions list for supplying laptops and other equipment to North Korea’s Defense Ministry. The department said at the time that the shipment included laptops, desktop computers, graphic cards, HDMI cables and network devices.

Strider suggested that the 35 firms connected to Liaoning China Trade Industry were effectively established by the North Korean regime. These firms served as conduits for placing North Korean IT personnel in jobs at Western companies, including in the United States.

Among the 35 companies, Strider highlighted three in particular as leaders in financing North Korea. These are Dandong Deyun Trading, registered as a wholesaler of textiles and electronics; Guangzhou Aiyixi Trading, a cosmetics and clothing wholesaler; and Yongping Zhuoren Mining, which is listed as a wholesaler of minerals and construction materials.

According to Axios, North Korean IT workers have for years taken jobs at U.S. companies under false pretenses to earn high salaries. The regime is believed to funnel those earnings into Pyongyang’s missile development program.

“Nearly every Fortune 500 company has struggled with the problem of North Korea-based IT workers trying to get hired at their firms,” Axios reported. “But few talk about the problem publicly over fears of law enforcement retaliation and embarrassment.”

In fact, Google disclosed at a recent conference that North Korean IT personnel had applied to join its workforce. Cybersecurity firm SentinelOne and software company KnowBe4 have also acknowledged hiring North Korean IT workers in the past.

North Korea’s strategy has recently shifted. While the initial focus was on generating foreign currency, the regime is now reportedly aiming to gather sensitive internal corporate data and intellectual property.

“Right now, what we’re all realizing is that the scope and scale of that enterprise is far greater than people originally knew,” Greg Levesque, CEO of Strider, told Axios.