Strider-Inside-Shadow-Network-Report.pdf (17 MB)

Strider describes North Korean IT workers using false or stolen identities to obtain freelance and remote developer roles at U.S. and other Western companies. The report links the activity to a state-directed revenue scheme that can expose employers to data theft, IP loss, compliance risk, and sanctions exposure while funding DPRK weapons programs. It also highlights recent DOJ indictments and Treasury sanctions tied to DPRK IT worker fraud. Strider's distinctive claim is that PRC-based support networks help enable these operations, with 35 organizations identified as possible material supporters of DPRK-linked activity.