North Korea's IT Worker Scheme Funds Russia's War Effort, DTEX Reports
North Korea's elaborate IT worker scheme is funneling millions of dollars through front companies and sanctioned entities to support Russia's war in Ukraine, according to a new report by DTEX.
North Korea's sophisticated scheme to deploy IT workers globally is now a significant financial pipeline, diverting millions of dollars to support Russia's ongoing war effort in Ukraine. A report released Tuesday by cybersecurity firm DTEX reveals that the illicit operation utilizes a complex network of front companies and sanctioned entities, including the defense procurement firm Korea Ryonbong General Corp, to move funds.
This financial flow extends beyond the regime's traditional focus on weapons development. DTEX's analysis indicates that the revenue generated by these IT workers is now contributing to a broader pool of funds that supports various regime objectives. This includes the manufacturing and supply of weapons and military equipment directly to Russia's armed forces, marking a significant diversification of the North Korean economy's illicit revenue streams.
Michael Barnhart, a nation-state investigator at DTEX and the report's lead author, highlighted this shift. "When we think IT workers, we typically think head down, get your money, support the weapons program," Barnhart stated. "It's a broad cover-all statement when we say it's supplying the weapons program. That's the predominant place it goes, but many other domestic programs and entities tasked with other projects are taking cuts from that pool of money as well."
DTEX's findings are corroborated by previously leaked data from an internal North Korean payment server. This data, which includes details on 390 IT worker accounts, chat logs, and transaction records, allowed Barnhart to map the flow of funds to several sanctioned entities, such as Sobaeksu, Saenal, and Songkwang. Specifically, between December 2025 and February 2026, over $1.97 million in payments from these IT workers were processed directly through Korea Ryonbong General Corp.
This revelation aligns with previous intelligence from Western officials and the Council on Foreign Relations, which have reported North Korea's provision of ammunition and weapons to Russia in 2023 and the deployment of thousands of North Korean soldiers to fight alongside Russian troops in late 2024. Barnhart emphasized the far-reaching consequences of this scheme, noting that "Revenue from the IT worker stream does not stop at a resume scam or a payroll-abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support."
The payment server data, initially published by ZachXBT in April, is managed by a single administrator identified as "PC-1234," whom DTEX has been monitoring. The associated wallet and its network of activity remain active. Over a three-month period, the wallet facilitated more than $2.84 million in transactions, with funds subsequently distributed to dozens of organizations.
Barnhart described the funding model as "bottom-up," where revenue is generated at lower levels and then funneled upwards. "Everyone makes money at the bottom and then they take a tiny cut, and then the money goes upwards to what we just blanketly say is the weapons program. But really, it can go a lot more places," he explained, underscoring the scheme's multifaceted support for the North Korean regime and its international partners.
The DTEX report underscores the evolving nature of state-sponsored cyber operations, demonstrating how seemingly disparate activities like IT worker schemes can be strategically leveraged to fund geopolitical objectives, including international conflicts.