\u201cWhen we think IT workers, we typically think head down, get your money, support the weapons program,\u201d\u00a0Michael Barnhart, nation state investigator at DTEX and lead author of the report, told CyberScoop.<\/p>\n
\u201cIt\u2019s a broad cover-all statement when we say it\u2019s supplying the weapons program,\u201d he said. \u201cThat\u2019s the predominant place it goes,\u201d but many other domestic programs and entities tasked with other projects are taking cuts from that pool of money as well.\u00a0<\/p>\n
Barnhart corroborated previously leaked data from an internal North Korean payment server, which included 390 IT worker accounts, chat logs<\/a> and transaction data<\/a>.<\/p>\n He mapped the transactions to organizations that received those funds, including multiple sanctioned entities: Sobaeksu, Saenal, and Songkwang.\u00a0<\/p>\n The money trail also showed $1.97 million in payments<\/a> from North Korean IT workers between December 2025 and February 2026 flowing directly through Korea Ryonbong General Corp<\/a>, a sanctioned defense entity that procures weapons for the regime\u2019s military programs.<\/p>\n Western officials previously reported that North Korea provided ammunition and weapons to Russia in 2023, and in the fall of 2024 sent upwards of 15,000 soldiers to fight alongside Russian troops, according to the Council on Foreign Relations<\/a>.<\/p>\n \u201cThis is a consequence that is often overlooked,\u201d Barnhart wrote in the report. \u201cRevenue from the IT worker stream does not stop at a resume scam or a payroll-abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support.\u201d\u00a0<\/p>\n
![\"Matt](\"https:\/\/www.europesays.com\/korea\/wp-content\/uploads\/2026\/07\/MattKapko.jpg\")
<\/p>\n