North Korean IT workers who obtain jobs at foreign companies to raise funds for the regime could one day become a vector for massive cyberattacks, a U.S. cybersecurity firm has warned, detailing the methods these workers use to gain employment under false pretenses and evade sanctions.

In a report published on Tuesday, Mandiant outlined DPRK IT professionals’ use of front companies and non-North Korean “facilitators” to conceal their identities in order to secure lucrative work at Western companies in a variety of fields, particularly in the U.S. technology sector.

The Google-owned security company