North Korean IT teams are expanding their remote-employment scheme by recruiting developers in countries such as Iran, Syria and South Africa to impersonate candidates, complete technical tests and establish contact with Western employers. Flare identified at least 14 recruited Iranians since 2024, including two who received U.S. job offers after interviewing for North Korean-linked applicants. Recruits may be approached through LinkedIn, coached to use false identities and paid in cryptocurrency, after which a North Korean operator can assume the secured job. Government assessments estimate that these schemes generate hundreds of millions of dollars annually for sanctions evasion and North Korea’s weapons programs, while also creating opportunities to steal sensitive corporate information.