Mandiant’s M-Trends 2026 reported that North Korean IT worker incidents showed a median dwell time of 122 days in 2025, matching the persistence observed in cyber espionage cases. The broader incident data shows attackers increasingly exploiting gaps in identity, SaaS access, and endpoint visibility, while espionage and insider-threat activity optimized for long-term access rather than immediate impact. Although the article covers many threat categories, the DPRK-relevant finding is that North Korean IT worker operations can remain embedded in organizations for months, creating sustained insider-risk exposure. This matters because remote-work hiring fraud is not only a sanctions-evasion issue but also a durable access problem for high-tech and other targeted sectors.