Adversary Intelligence — 2026-07-22

DTEX Research Shows North Korea IT Worker Scheme Funnels Revenue to Russia War Effort Through Sanctioned Defense Entities

BLUFPyongyang's IT worker revenue pipeline now feeds directly into sanctioned Russian defense procurement channels, converting low-profile cyber labor into wartime materiel support with no apparent interdiction pressure.

DTEX Systems reported on Tuesday that revenue from North Korea's IT worker scheme is being funneled through front companies and sanctioned entities to help fund Russia's war effort, extending beyond the regime's weapons program into a broader pool supporting multiple state objectives 1. DTEX lead investigator Michael Barnhart traced the money trail using previously leaked data from a North Korean internal payment server covering 390 IT worker accounts, chat logs, and transaction records 1. The mapped transactions identified payments to sanctioned entities Sobaeksu, Saenal, and Songkwang, and showed $1.97 million flowing between December and February directly through Korea Ryonbong General Corp, a sanctioned defense entity that procures weapons for North Korea's military programs 1. Total wallet activity over the same three-month period reached $2.84 million, dispersed upward into dozens of organizations beyond the named sanctioned entities 1. DTEX attributed control of the wallet cluster behind the payment server data, first published by researcher ZachXBT in April, to a single administrator it tracks as "PC-1234," and assessed the wallet remains active 1.

Analysis
DTEX's tracing of leaked payment-server data ties North Korea's IT-worker revenue directly to Korea Ryonbong General Corp, moving the scheme from peripheral sanctions evasion into direct material support for Russia's war logistics, though DTEX Systems remains the sole original investigator with CyberScoop and SC Media only amplifying rather than independently corroborating the findings. The bottom-up structure, local cuts aggregating upward through sanctioned intermediaries, leaves no single choke point for interdiction, and continued activity from the "PC-1234" wallet cluster shows the scheme running undisrupted despite public attribution. The mapped flows could instead reflect Pyongyang's fungible state treasury commingling funds rather than a deliberate IT-worker-to-Russia pipeline.

3 sources

North Korea IT worker scheme funds Russia war effort - CyberScoop
North Korea's IT worker scheme funds Russia's war effort, report finds - SC Media
From Payroll to Pyongyang: The DPRK IT Worker Money Trail - DTEX Systems (i3 Research Center)