North Korean (DPRK) IT workers are ramping up their corporate infiltration efforts into tech and crypto firms, with a focus on Europe.

Since its last report in September 2024, Google Threat Intelligence Group has observed a rise in DPRK IT workers infiltrating tech and crypto firms in multiple countries across Europe. These individuals use fake identities and create multiple fake personas to secure high-paying jobs at tech and blockchain companies, often using additional fabricated personas for references. In one case, a single individual was found operating under at least 12 different personas across Europe and the U.S., targeting organizations within the defense and government sectors.