Loading story…
North Korean-linked IT worker operations have expanded in scale and geography, using fabricated identities, false references, and multiple online personas to secure remote jobs in the United States and Europe, including roles tied to government and the defense industrial base. Google threat intelligence reported that some operators managed a dozen personas at once, recruited through platforms such as Upwork, Telegram, and Freelancer, while facilitators helped bypass identity checks and move payments through cryptocurrency, TransferWise, and Payoneer. The activity has also evolved beyond revenue generation: since late 2024, recently fired workers have increasingly threatened to leak sensitive data and source code, and investigators observed cases in which company-issued devices were redirected across borders and false-resume infrastructure supported the scheme.
The campaign reflects a broader breakdown in trust around digital identity verification as deepfakes and voice cloning become more convincing. U.S. agencies including NSA, FBI, and CISA have warned that synthetic media can be used to deceive organizations and critical infrastructure operators, while recent incidents showed the operational impact: an employee at Arup was reportedly tricked by AI-generated executive impersonations into sending about $25 million across 15 transfers, and KnowBe4 disclosed hiring a fake employee later identified as a North Korean operative who attempted to deploy malware. Security guidance increasingly recommends layered, low-tech controls such as out-of-band verification, hardware-backed MFA, dual approval for sensitive transactions, and role-specific authentication procedures rather than relying on video, voice, or automated deepfake detection alone.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
By January 2025, DPRK IT workers were conducting operations against employers using BYOD and virtual workspace access models, which the report says can reduce monitoring and hinder detection.
Since late October 2024, Google Threat Intelligence Group assessed that DPRK IT workers increased extortion attempts, threatening to leak former employers' sensitive data and source code and targeting larger organizations.
In late 2024, one DPRK IT worker operated at least 12 personas across Europe and the United States while seeking jobs, including roles tied to European defense industrial base and government organizations.
In 2024, KnowBe4 hired an individual who passed interviews and screening before being identified as a North Korean operative; after receiving a workstation, the person attempted to introduce malware into the company's systems.
In January 2024, an Arup employee joined a video call with AI-generated clones posing as company executives and was induced to make 15 transfers totaling about $25 million to third-party accounts.
On September 12, 2023, the NSA, FBI, and CISA jointly released the Cybersecurity Information Sheet "Contextualizing Deepfake Threats to Organizations" covering synthetic media threats, techniques, trends, and defensive recommendations.
The ZDNet article says Google Threat Intelligence Group has investigated fake-employee incidents linked to North Korean operators since 2022.
The CISA alert states that U.S. Government organizations collaborated between 2021 and 2022 to establish employable best practices for preparing for and responding to synthetic media threats.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcecloud.google.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Aug 18, 2026
Reporting highlighted ongoing **North Korean IT worker** operations in which individuals use **stolen identities, falsified resumes, and AI-enabled deepfakes** to obtain remote roles at Western companies, creating direct insider-risk exposure once hired. The activity was described as affecting **thousands** of workers and **Fortune 500** employers, with claims of "**3,000 hands on keyboards**" and roughly "**30,000 different email addresses**" in use to support multiple personas, generating wages that can total **hundreds of millions of dollars annually** and help fund the North Korean regime. Recommended screening and verification measures focused on practical controls for remote hiring, including prompting candidates to **perform live actions on video** (e.g., wave), validating **IP address/geolocation consistency** with claimed location, and probing discrepancies in a candidate’s stated whereabouts. The reporting framed these checks as necessary to counter identity fraud and synthetic media used to pass interviews and onboarding, and to reduce the likelihood of granting network access to sanctioned or malicious actors operating under false identities.
Jun 29, 2026