North Korea’s armies of overseas IT workers have long raised illicit funds for Pyongyang’s nuclear ambitions, but a series of breaches has highlighted the growing danger of such workers using their positions to carry out cyberattacks.

A DPRK remote worker cluster that likely operates from Laos abused its access to a U.S.-based IT firm’s systems to infiltrate other companies, U.S. cybersecurity firm Palo Alto Networks’ Unit 42 threat research team reported last week.

The cluster’s dual focus on cyber intrusions and remote work to generate revenue showcases how two