Mandiant M-Trends 2025 (PDF)
DPRK IT workers placed outside North Korea as remote IT contractors (UNC5267) · M-Trends 2025 (report year; no day-level date on PDF)
Since 2022, Mandiant has tracked a threat cluster it refers to as UNC5267, which represents the DPRK’s efforts to place thousands of its citizens in countries outside of North Korea to pose as remote IT contractors for Western companies.