The Justice Department says sanctioned North Korean hackers have gotten inside dozens of U.S. companies.
Authorities say the hackers are increasingly recruiting Americans to serve as facilitators, middlemen who connect breached U.S. firms to operatives in Pyongyang. The warning does not name specific companies or detail how the breaches happened. It does mark an escalation in how officials describe the scale of the infiltration, moving from isolated incidents to a pattern spanning dozens of firms.
This fits a well-documented North Korean playbook: using remote IT workers and local accomplices to get a foothold inside Western companies, often to generate revenue or steal data under sanctions pressure. What is new here is the emphasis on American facilitators as the connective tissue, a sign investigators think the weak link is domestic, not just offshore infrastructure.
If the DOJ is right about the scale, the fix is not another phishing training module. It is companies actually checking who is on the other end of a remote hire.