WageMole

Wagemole is a North Korea-linked, state-sponsored threat activity cluster associated with the DPRK fraudulent IT worker program. It is also tracked as UNC5267 and referred to in reporting as DPRK IT worker activity, DPRK IT worker network/operations/program/schemes, DPRK IT workers, North Korean IT worker schemes, and ITW. Reporting describes Wagemole as a distinct but related cluster to Contagious Interview / DeceptiveDevelopment: DeceptiveDevelopment compromises developers through fake recruiter and interview lures, then appears to hand off stolen information and identities to Wagemole operators, who pose as job seekers. The core Wagemole tradecraft is employment fraud rather than conventional malware deployment. Operators use stolen, fabricated, or synthetic identities, forged resumes, fake references, LinkedIn profiles, and well-maintained GitHub accounts to obtain remote employment, especially at Western companies and particularly in the U.S. tech sector, though activity has expanded into Europe. GitHub repositories have been used to host resumes tied to forged identities impersonating multiple nationalities. Reporting also describes AI-assisted fake persona creation, proxy interviewing, use of facilitators, and schemes to defeat identity verification and receive funds. Facilitators in the U.S., U.K., and Europe have supported laptop access, identity verification bypass, and payment routing. Targets include technology companies and other organizations in the U.S. and Europe, with reporting specifically noting software development, Web3, blockchain infrastructure, and, in Europe, defense industrial base and government organizations. The objective is to generate illicit revenue for the DPRK regime and its weapons programs, while also creating insider access opportunities inside victim organizations. Multiple sources note the risk that embedded workers can steal proprietary data or source code, extort employers after termination, or provide a foothold for follow-on malicious activity such as malware deployment, cryptomining, or theft of secrets. Public reporting cited in the content states that Mandiant classified DPRK IT worker operations as UNC5267, and Google attributed 3% of analyzed intrusions in the second half of 2025 to North Korean IT workers using fraudulent identities to obtain employment and generate revenue. Additional reporting attributes a fake front company, DredSoftLabs, to Wagemole and notes abuse of GitLab infrastructure in tracking and response to Contagious Interview and Wagemole clusters.