Strider Report Uncovers PRC-Based Network of Companies Affiliated with Organization Sanctioned for Aiding North Korean IT Worker Scheme

Research uncovered 35 companies based in the People’s Republic of China that may be helping generate illicit revenue for the DPRK government

Salt Lake City, May 13, 2025 – Strider Technologies, Inc. (“Strider”), the leading provider of strategic intelligence, today published a new report describing how North Korean actors, often with the support of entities within the People’s Republic of China, work to penetrate digital workforces of Western organizations to access sensitive data, advance geopolitical goals, and generate and launder illicit proceeds. 

Strider’s report—Inside the Shadow Network: North Korean IT Workers and Their PRC Backers—lays out the role PRC-based entities play in these DPRK operations, which often involve facilitators and front companies based in China. These intermediaries are crucial in enabling the DPRK’s use of digital platforms, payment systems, and employment marketplaces, creating a cross-border infrastructure that helps obscure the origins of the workers and facilitates the laundering of illicit proceeds.

Strider identified one of these PRC-affiliated front companies by name—Liaoning China Trade Industry Co., Ltd.—which has been sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for shipping IT equipment to Department 53 of The DPRK’s Ministry of The People’s Armed Forces. Department 53 is a weapons-trading entity subordinate to North Korea’s Ministry of National Defense that is reportedly involved in selling advanced conventional weapons and military-grade communications equipment and generating revenue through front companies in various sectors, including IT and software development.

Further investigation into Liaoning China Trade uncovered a shadow network of 35 other PRC-based companies that are linked to the OFAC-sanctioned company through organizational and personal connections—including Dandong Deyun Trading Co., Ltd.; Guangzhou Aiyixi Trading Co., Ltd.; and Yongping Zhuoren Mining Co., Ltd. These 35 Liaoning China Trade-affiliated companies could also be materially supporting Department 53.

“North Korean actors, often posing as freelance developers or engineers, are engaged in a coordinated DPRK campaign to infiltrate Western organizations and generate desperately needed revenue,” said Greg Levesque, CEO and Co-Founder of Strider. “Our research at Strider reveals how front companies based in the PRC are enabling these global operations, providing cover and infrastructure for North Korean IT workers to operate undetected. A business that hires any fraudulent worker can face financial losses, IP theft, and data breaches. However, these risks increase exponentially if a company unwittingly hires a DPRK national because their earnings directly fund sanctioned weapons programs and help the regime bypass international restrictions.”

The report also details the tactics, techniques, and procedures used by these North Korean operatives, including the use of fake identities, front companies, and the exploitation of global freelancing platforms; outlines the risks North Korean IT workers pose to Western businesses; and maps the spread of these workers across the globe.

The full Inside the Shadow Network: North Korean IT Workers and Their PRC Backers report can be found here.

About Strider

Strider is the leading strategic intelligence company empowering organizations to secure and advance their technology and innovation. Leveraging cutting-edge AI technology alongside proprietary methodologies, Strider transforms publicly available data into critical insights. This increased intelligence enables organizations to proactively address and respond to risks associated with state-sponsored intellectual property theft, targeted talent acquisition, and third-party partners. Strider has operations in 15 countries around the globe with offices in Salt Lake City, Washington, DC, London, and Tokyo.