Loading story…
Recorded Future reported that a North Korean-linked operation it tracks as PurpleDelta used fabricated IT worker personas to apply for jobs at foreign companies at scale, overwhelming hiring teams and gaining employment inside targeted organizations. The campaign relied on AI-generated profile photos, custom ChatGPT assistants, illicit identity-document generation services, rented accounts accessed through AnyDesk, and coordination over Telegram and Slack to support fraudulent applications and remote work activity.
Researchers said the operation targeted software, technology, healthcare, and biotechnology firms and successfully infiltrated at least 10 organizations. Once inside, the fake workers allegedly collected intelligence and exfiltrated proprietary data, source code, and internal communications, turning the scheme into both an espionage and revenue-generating operation. Recorded Future said proceeds from the activity are often directed toward sanctioned North Korean military and nuclear programs, elevating the threat beyond hiring fraud.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Recorded Future reported that groups of fake North Korean IT workers it tracks as PurpleDelta were running large-scale fraudulent employment operations using fabricated personas to obtain jobs at foreign companies. The research said the operation had infiltrated at least 10 organizations and was used for both revenue generation and intelligence collection, including exfiltration of proprietary data, source code, and internal communications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcebsky.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Aug 18, 2026
North Korean (**DPRK**) operatives running the long-standing “remote IT worker” scheme have escalated their tradecraft by applying for remote roles using **real LinkedIn accounts of legitimate professionals they are impersonating**, rather than relying primarily on fully synthetic personas. Reporting attributes the finding to analysis shared by **Security Alliance (SEAL)**, noting that the hijacked/impersonated profiles can appear highly credible—sometimes featuring *verified workplace emails* and *identity badges*—making initial recruiter screening and identity verification more difficult. The operation’s objectives remain consistent: generate revenue for the regime (including via salary payments later moved through cryptocurrency laundering techniques such as **chain-hopping/token swapping** and use of **DEXs/bridges**) while also enabling **access to sensitive corporate environments** for espionage, persistence, and potential follow-on extortion. The activity is described as high-volume and is tracked under multiple names in the security community (including **Jasper Sleet**, **PurpleDelta**, and **Wagemole**), with prior research noting that once placed, these operators can obtain administrative access to codebases and blend in using living-off-the-land techniques within enterprise infrastructure.
Jun 29, 2026