Loading story…
Huntress identified five 2026 incidents in which suspected North Korean operatives linked to FAMOUS CHOLLIMA secured legitimate remote jobs at partner organizations using fraudulent identities. The workers targeted not only IT roles but also positions in healthcare, financial services, sales, and marketing, with their salaries allegedly contributing to revenue for the sanctioned DPRK regime.
Investigations uncovered forged or altered identity documents, VPN and proxy infrastructure associated with DPRK worker operations, PiKVM hardware for remote device control, webcam-video relay equipment, and behavior consistent with laptop farms. Huntress advised organizations to strengthen remote-hire identity checks and detect the campaign through combined document-forensics, infrastructure, hardware, and behavioral monitoring rather than any single indicator.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
The Bluesky account lazarusholic shared Huntress research titled “Insights into Suspected DPRK Workers: Red Flags to Look Out For,” associating the activity with ITWorker, Famous Chollima, PiKVM, and Guermok labels.
Matthew Isaac Knoot and Erick Ntekereze Prince were each sentenced to 18 months in prison for operating laptop farms for North Korean remote IT workers. Their schemes affected nearly 70 U.S. companies and generated a combined $1.2 million in illicit revenue.
Huntress documented five confirmed 2026 cases in which DPRK-aligned workers tracked as FAMOUS CHOLLIMA obtained remote positions at Western companies using fake or stolen identities. The workers filled IT, healthcare, and sales-and-marketing roles, sometimes performed legitimate work, and reportedly remitted part of their earnings to North Korea.
Huntress proactively identified a sales-and-marketing worker using documents matching a real person's name, birth date, and license location, with the photograph and signature digitally altered. The worker's device also contained video-relay and English-language-assistance artifacts, and the worker posted recurring Zoom credentials publicly.
At a financial-services firm, Huntress found a PiKVM attached to a newly onboarded employee's device, along with a capture card capable of relaying external video into webcam applications. The device's connectivity and the employee's refusal to appear on camera were assessed as consistent with a laptop-farm arrangement.
An Australian partner organization identified three suspicious healthcare employees whose activity traced to VPN and proxy infrastructure previously associated with DPRK IT-worker campaigns. Document similarities and metadata tied two of the workers' purported identities together.
The U.S. Justice Department announced indictments of two North Korean nationals and three facilitators for fraudulent remote work conducted between 2018 and 2024. The defendants allegedly generated at least $866,255 from ten of at least 64 infiltrated U.S. companies.
Recorded Future reported that the DPRK-linked PurpleDelta IT-worker cluster created at least 22 fabricated personas that applied for jobs through platforms including LinkedIn and Upwork, at volumes of up to 60 applications per day. The operations reportedly collected intelligence and exfiltrated proprietary data, source code, and internal communications.
Dutch authorities raided a bulletproof-hosting provider used alongside Astrill VPN infrastructure connected to the suspicious healthcare workers. The source states the raid occurred after the infrastructure was identified but does not provide a date.
Mandiant reported that DPRK-linked IT workers tracked as UNC5267 used fraudulent and reused resumes, stolen-identity locations, laptop farms, IP-based KVMs, and multiple remote-administration tools to obtain and perform remote jobs. Mandiant also observed Astrill VPN-linked access likely originating from China or North Korea and issued HR and technical mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourceitpro.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourcemicrosoft.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting highlighted ongoing **North Korean IT worker** operations in which individuals use **stolen identities, falsified resumes, and AI-enabled deepfakes** to obtain remote roles at Western companies, creating direct insider-risk exposure once hired. The activity was described as affecting **thousands** of workers and **Fortune 500** employers, with claims of "**3,000 hands on keyboards**" and roughly "**30,000 different email addresses**" in use to support multiple personas, generating wages that can total **hundreds of millions of dollars annually** and help fund the North Korean regime. Recommended screening and verification measures focused on practical controls for remote hiring, including prompting candidates to **perform live actions on video** (e.g., wave), validating **IP address/geolocation consistency** with claimed location, and probing discrepancies in a candidate’s stated whereabouts. The reporting framed these checks as necessary to counter identity fraud and synthetic media used to pass interviews and onboarding, and to reduce the likelihood of granting network access to sanctioned or malicious actors operating under false identities.
Jun 29, 2026
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Aug 18, 2026
North Korean (**DPRK**) operatives running the long-standing “remote IT worker” scheme have escalated their tradecraft by applying for remote roles using **real LinkedIn accounts of legitimate professionals they are impersonating**, rather than relying primarily on fully synthetic personas. Reporting attributes the finding to analysis shared by **Security Alliance (SEAL)**, noting that the hijacked/impersonated profiles can appear highly credible—sometimes featuring *verified workplace emails* and *identity badges*—making initial recruiter screening and identity verification more difficult. The operation’s objectives remain consistent: generate revenue for the regime (including via salary payments later moved through cryptocurrency laundering techniques such as **chain-hopping/token swapping** and use of **DEXs/bridges**) while also enabling **access to sensitive corporate environments** for espionage, persistence, and potential follow-on extortion. The activity is described as high-volume and is tracked under multiple names in the security community (including **Jasper Sleet**, **PurpleDelta**, and **Wagemole**), with prior research noting that once placed, these operators can obtain administrative access to codebases and blend in using living-off-the-land techniques within enterprise infrastructure.
Jun 29, 2026