Loading story…
Researchers from 38 North, with assistance from Mandiant, reported that a misconfigured cloud server tied to a North Korean IP address exposed thousands of production files indicating North Korean workers may have contributed to international animation projects despite sanctions. The openly accessible server reportedly contained animation cells, videos, workflow documents, and editing notes translated from Chinese into Korean, suggesting a subcontracting chain that obscured the workers’ origin from major studios and distributors.
The leaked materials were linked to projects including Amazon Prime Video’s Invincible season 3, Max and Cartoon Network’s Iyanu: Child of Wonder, and additional Japanese animation work. According to the reporting, the server remained accessible without authentication and appeared to stop being actively used at the end of February, highlighting how North Korea may be generating revenue through skilled IT and creative labor embedded deep within global outsourcing networks.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
The Stimson Center's 38 North Project published findings, with assistance from Mandiant, linking files on the exposed server to international animation projects including Invincible season 3, Iyanu: Child of Wonder, and Japanese anime work. The report said the evidence suggested North Korean workers were contributing to outsourced animation production, likely without the knowledge of the major production companies.
The exposed server reportedly ceased being used at the end of February, although it remained live and accessible. Researchers said its contents were still exposed despite the apparent halt in activity.
In December, researcher Nick Roy found a misconfigured cloud server on a North Korean IP address that exposed thousands of animation-related files without authentication. The server was reportedly being updated daily at the time and appeared to be used to transfer work to and from North Korean animators.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
38north.org
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open-source reporting detailed how North Korean entities market domestically developed software for foreign customers while also placing disguised IT workers into overseas jobs, underscoring a broader effort to generate revenue through the global technology sector. One report cataloged North Korean software offerings presented for export, indicating an organized commercial ecosystem that promotes applications and development services beyond the country’s borders. A separate OSINT analysis examined North Korean remote IT worker operations, describing how personnel allegedly conceal their identities to obtain employment with foreign companies. Together, the reports show Pyongyang-linked technology operations using both formal software export channels and covert freelance or remote employment schemes to earn foreign currency, creating compliance, insider-risk, and sanctions-enforcement concerns for organizations hiring distributed technical staff or sourcing software development services.
Jul 8, 2026
Amazon has identified and blocked over 1,800 suspected North Korean operatives attempting to secure remote IT jobs within the company since April 2024. These individuals, often using fake or stolen identities and leveraging AI tools or deepfakes, seek employment to funnel wages back to the North Korean regime, which uses the funds to support weapons programs. The company has observed a 27% quarter-over-quarter increase in such applications, highlighting the growing scale and sophistication of these operations. In one notable case, a North Korean imposter working as a sysadmin was detected due to a suspicious 110ms keystroke input lag, which raised red flags about the worker's true location. The U.S. government and security researchers warn that this tactic is widespread, with most Fortune 500 companies believed to have been targeted or infiltrated, resulting in tens of millions of dollars in losses. Beyond financial gain, some North Korean operatives have used their access to steal proprietary data and extort employers. Additionally, DPRK-linked threat actors have developed advanced malware, such as a new variant of BeaverTail, to further support their cyber operations. Amazon's proactive detection and response efforts underscore the ongoing threat posed by North Korean state-sponsored cyber actors to major Western technology firms.
Jun 29, 2026
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Aug 18, 2026