Fake interviews on LinkedIn: Western intelligence agencies say North Korea is behind them

The first obstacle, therefore, remains user behaviour. Hence the Agency’s reminder of the importance of ‘emphasising the fundamental importance of always verifying online offers, contacts and requests, particularly when personal data, documents, credentials or software installation are involved’.

It is the software installation itself that is the most sensitive stage: the fake interview can become a means of introducing malicious code into the victim’s systems and subsequently attempting to move around the network.

Western intelligence agencies are now said to have identified North Korea as the mastermind behind these activities. And the pattern described matches a strategy already pieced together by the US authorities.

According to the US State Department, ‘North Korea relies on a network of cyber experts, based both inside and outside the country, to obtain false identities and make money remotely, thereby financing its illegal nuclear and missile programmes’.

The system does not rely solely on traditional cyber-attacks. Pyongyang also employs IT staff who attempt to infiltrate foreign companies under false pretences.

‘North Korean IT workers pose as citizens of other countries to secure work and an income through online platforms run by private companies specialising in recruitment, tendering and the conclusion of service contracts. These workers seek contracts with the intention of transferring their salaries to the North Korean agencies for which they work. They also pose an internal threat to companies and are involved in data exfiltration, cryptocurrency theft and the theft of sensitive information. North Korean cyber workers are employing increasingly sophisticated methods, including the integration of artificial intelligence, to conceal their identities and expand their activities globally.”

The benefit for the regime is twofold: to secure financial resources and, at the same time, to establish potential points of access within foreign organisations.

The North Korean lead is part of what has now become a structural phenomenon. Western reports on cyber security frequently refer to hacker groups described as linked to ‘state actors’: behind this term lie, above all, Russia, China and North Korea.

In July 2026, the United States and other allied countries attributed a cyber-espionage campaign to the Russian group Laundry Bear; the campaign had initially targeted Ukrainian entities before being extended to NATO member states. The hackers exploited vulnerabilities in email systems to steal emails and sensitive information.

On the Chinese front, in August the US authorities linked a wide-ranging campaign targeting public administrations, energy research laboratories, defence companies, financial institutions and universities to individuals believed to be close to Beijing’s intelligence services and military apparatus. China has rejected the allegations.

North Korea, on the other hand, presents a unique case: cyber operations are used not only to gather intelligence, but also to generate money. Microsoft has reported activity linked to cryptocurrencies and the placement of IT workers under false identities in foreign companies.

The figure for Italia is significant. In Microsoft’s Digital Defence Report 2025, Italia ranks second in terms of reports relating to activities attributed to North Korean actors, accounting for 13 per cent, behind the United States.

The line between cybercrime, espionage and state strategy is thus becoming increasingly blurred. And the threat may originate from critical infrastructure, a vulnerable email account or, quite simply, a job offer received on LinkedIn.