Okta Threat Intelligence found that DPRK IT-worker operations now affect remote-hiring organizations far beyond U.S. big technology companies. The investigation tracked more than 130 facilitator and worker identities tied to over 6,500 initial job interviews across more than 5,000 companies through mid-2025, with targets spanning finance, healthcare, public administration, professional services, software development, IT consulting, and AI-focused organizations. The scheme relies on identity fraud, facilitators, tailored resumes and applications, remote interviews, and post-onboarding corporate access to obtain wages, with some cases also involving sensitive-data theft, extortion, or ransomware-related activity. Okta notes that only about half of targeted entities in its sample were information technology organizations and that more than a quarter were outside the United States, showing the operation’s wider sector and geographic reach. The access created by successful placements matters because it can provide both revenue and potential intelligence or disruption capability for the DPRK regime.