Google Threat Intelligence Group (GTIG) has revealed that North Korean IT workers are now targeting European crypto companies, marking a significant expansion of their operations beyond the United States. The report highlights how these individuals falsely claim to be from other countries and secure remote jobs at various organizations in the UK and Europe, posing risks such as espionage, data theft, and operational disruption. 
The GTIG report, published on April 2nd, 2025, provides further details on these threats. It reveals that North Korean workers have been involved in a wide range of projects using popular technologies like Next.js, React, CosmosSDK, Golang, and AI tools. Notably, they’ve also leveraged blockchain platforms such as MERN stack and Solana to develop various job-related applications.