“This is the mafia,” Michael “Barni” Barnhart, an investigator who leads DTEX’s DPRK efforts, told Fortune.
The economic structure ensures the money travels up the chain, spans multiple criminal enterprises, and is based on tight-knit but competitive internal relationships. Like in The Sopranos, titular mob boss Tony Soprano calls the shots, while capos like Christopher Moltisanti deliver whatever he needs, he said.
“The profits—from ransomware, cryptocurrency theft, financial fraud, and insider infiltration— flow upward to fund weapons development and sanctions evasion,” states the report, written by Barnhart. (He is the author, but notes that he sourced his intelligence from an extensive global alliance of investigators.)
According to the report, many of the IT workers and APT actors know each other. As part of the scheme, children who show promise in math and science in elementary school are plucked from an early age to get training as a military cyber operative or an IT worker. They attend elite schools like the Kim Sung Il Military University and the Kumsong Academy together and learn advanced computer science in a constantly replenished talent pipeline.
Cyber investigators call it a “bro network,” and have found chats between workers who lean on old school friends to find out how to make more money, explained Barhart. An image of two verified IT workers published by DTEX shows happy-looking young guys with nice watches and Nike-branded gear hanging out. Many of the operatives who ran successful heists a decade ago are now in managerial positions or serving as advisors and professors for the new generation of IT workers, said Barnhart.
However, the photos don’t show a particularly brutal twist in the scheme: the various four- or five-man delegations of workers are encouraged to compete against each other.
Barnhart described it as a “dog eat dog world where the only real winners are Kim Jong Un’s family and the North Korean elites.” While much of the revenue that’s generated funds operations and weapons, some goes to purchasing luxury goods for Kim and his family, said Barnhart.
In 2025, North Korea doubled the monthly financial quota for workers in China, the report revealed, and Barnhart said all workers—IT and otherwise—faced the same punishing new requirement to keep foreign money pouring into the regime. The workers face grueling, 16-hour days up to six days a week, with hardly any breaks. Thus, the friendly “bro network” operates on a case-by-case basis, noted Barnhart.
The competition is exacerbated by the need to bring in more cash and crypto. On average, workers get to keep less than 20% of their earnings and they have to fund operations, equipment, and servers with their own money. In one documented example in the report, a worker earned $5,000 in a month and was allowed to keep $200.
“These quotas also foster a culture of competition within teams, with workers seeking to gain advantages over their colleagues to receive favors and be allowed to send more money back to their families,” Barnhart wrote. “They’re also encouraged to report each other for ‘unpatriotic’ behavior.”
Barhnart said it’s very much “every man out there is for himself” and the workers are beaten if they don’t make enough money.
“It is a rough life,” he said. “If they can’t make their quotas, we see them at times mention (beatings).”
Another picture DTEX published showed IT workers in a cramped space working on doctored IDs and WhatsApp chats with a mounted camera on the wall for government monitoring. Barnhart said the competition for work on freelance-job platforms where the IT workers find new opportunities is intense. He estimated that it takes roughly three hours to get a North Korean IT worker to apply for a job posting if it’s related to crypto and software development.
Some of the workers have even resorted to reporting each other on the freelance platforms, with one IT worker calling another a “scammer” in a reply to a post from an IT worker seeking a job. The report states that the pressures on workers to generate revenues has given rise to side hustles, which are allowed as long as they continue to increase their earnings.
Much like the mafia, financial gain, fear, violence, and identity are drivers of the IT worker scheme, but Barnhart wrote that what sets the DPRK apart is the “survival-based incentive structure at the heart of its engine.”
“Cyber operatives are not motivated by ideology, but by material necessities: food, shelter, healthcare, and education for their families,” he wrote. “Loyalty is not the core driver. Survival is.”
Read more about North Korea’s IT workers scheme:
