North Korean operatives enter U.S. firms posing as remote IT workers, earning revenue before some are shifted to intelligence gathering

North Korean operatives are infiltrating U.S. companies by the hundreds while posing as remote IT workers, according to the post. Cybersecurity firm CrowdStrike says it is uncovering one or two suspected cases each day.

The operation initially generates revenue for Pyongyang, with the workers taking in U.S. money until they reach a “juicy target.”

If a fake worker gets a job at a defense contractor or a company handling classified projects, CrowdStrike says the operation is handed to a malware team to collect intelligence.