"When we think IT workers, we typically think head down, get your money, support the weapons program," Michael Barnhart, nation state investigator at DTEX and lead author of the firm's report, told CyberScoop. "It's a broad cover-all statement when we say it's supplying the weapons program."
DTEX says an IT worker payroll scheme is funding wider state aims
Security firm DTEX reports that a long-running North Korean scheme that places IT workers abroad is routing revenue not only into the regime's weapons program but into a broader pool that supports multiple state objectives — including the manufacture of weapons and their transfer to Russia's military. DTEX’s research, published in a report shared with CyberScoop on Tuesday, says the operators funnel money through a web of front companies and intermediaries, and that some of those intermediaries are sanctioned entities.
The PC-1234 payment server and leaked dataset
DTEX corroborated data first published in April by researcher ZachXBT from an internal North Korean payment server controlled by a single administrator identified in the dataset as "PC-1234." That leaked data set contains 390 IT worker accounts, chat logs and transaction records. DTEX traced the wallet and its cluster of activity and says the wallet remains active.
Figures: payments traceable to sanctioned procurement
DTEX mapped three months of activity attributed to the PC-1234 wallet and found more than $2.84 million moved upward into dozens of organizations over that period. Within that flow, the firm identified $1.97 million in payments from North Korean IT workers between December 2025 and February 2026 that moved directly through Korea Ryonbong General Corp — a sanctioned defense entity that DTEX says procures weapons for the regime’s military programs.
Sanctioned entities named in the flow: Sobaeksu, Saenal, Songkwang
In its transactional mapping, DTEX connected portions of the IT worker payments to multiple sanctioned entities, including Sobaeksu, Saenal, and Songkwang. The report frames those links as evidence that revenue from the IT worker stream can feed sanctioned procurement channels as well as other domestic state needs, not merely payroll abuse or resume scams.
How technologists, policymakers, and militaries are affected
- Technologists and security teams: Researchers and defenders will monitor the active PC-1234 wallet cluster and the pattern of front companies and intermediaries DTEX identified, because the scheme uses apparently legitimate employment streams as a cover for moving funds to sanctioned entities.
- Policymakers and sanctions enforcers: The mapping of nearly $2 million in transfers through a known sanctioned defense procurer between December 2025 and February 2026 highlights enforcement touchpoints — financial intermediaries and named companies — that DTEX says link payroll revenue to procurement for military programs.
- Armed forces and procurement watchers: Western officials previously reported that North Korea provided ammunition and weapons to Russia in 2023 and that in the fall of 2024 the country sent upwards of 15,000 soldiers to fight alongside Russian troops, according to the Council on Foreign Relations; DTEX frames the IT worker scheme as another revenue stream that can be directed toward those uses.
Barnhart summarized the mechanism in blunt terms: "It's not a top-down funded regime. It's a bottom-up. Everyone makes money at the bottom and then they take a tiny cut, and then the money goes upwards to what we just blanketly say is the weapons program. But really, it can go a lot more places." He also warned that the consequences are often overlooked, writing that "Revenue from the IT worker stream does not stop at a resume scam or a payroll-abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support."
The DTEX report ties together three threads made visible by the leaked payment-server data: a single administrator (PC-1234) controlling an active wallet cluster; a set of nearly 400 IT worker accounts whose payroll contributed millions over months; and named flow paths through sanctioned entities, including a recognized defense procurement organization. Those facts, as DTEX presents them, shift the narrative about so-called IT worker schemes from isolated fraud to a financial conduit feeding state-directed programs.
The record DTEX cites leaves a clear, immediate question: with an active wallet cluster and traceable payments already identified, which financial and enforcement levers will be used next to interrupt funds routed through the named intermediaries and sanctioned entities? DTEX’s mapping supplies the specific names and figures that would be required to pursue that step.
https://cyberscoop.com/north-korea-it-worker-scheme-funds-russia-war-ukraine/
