North Korea IT worker scheme funds Russia's war effort, DTEX says
This digest was compiled by AI from multiple sources — links to the originals are below.
North Korea's IT worker scheme is funneling money through front companies to partly fund Russia's war in Ukraine, security firm DTEX said in a report Tuesday. The funds support sanctioned entities and weapons manufacturing for Russia's military, according to the report.
The Money Trail
DTEX traced $1.97 million in payments from North Korean IT workers between December 2025 and February 2026 flowing through Korea Ryonbong General Corp, a sanctioned defense entity. The funds also passed through other sanctioned organizations: Sobaeksu, Saenal, and Songkwang. The three-month activity attributed to a single administrator wallet, PC-1234, amounted to over $2.84 million, which then flowed to dozens of organizations.
Broader Implications
Michael Barnhart, lead author of the report, said the scheme goes beyond funding North Korea's weapons program, supporting many regime objectives including weapons manufacturing for Russia. Western officials previously reported North Korea sent ammunition and weapons to Russia in 2023 and over 15,000 soldiers in fall 2024. Barnhart noted the revenue feeds a larger system supporting sanctioned entities and Russia's war effort.
What's Next
DTEX continues to monitor the PC-1234 wallet, which remains active. It remains unclear how much additional funding has flowed through the scheme since February 2026.
2 sources
North Korea IT worker scheme funds Russia's war effort, DTEX says
