> [!hm-nav] > ** [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]] > [!hm-intro] > INDEPENDENT SECURITY RESEARCH > > ## Hayden McKenzie > > Behind the identities. Inside the operations. > > Independent investigations into North Korean IT worker fraud, the infrastructure that enables it, and the people behind it. First-hand observation. Primary-source evidence. > > [[About|About my work ↗]] · [Get in touch ↗](mailto:[email protected]) > > DPRK OPERATIONS / OSINT / INSIDER THREAT > [!hm-hero] > LATEST RESEARCH / 03 > > # The Identity Lifecycle,<br>*Part 2.* > > 19 Aug 2026 · DPRK operations > > Inside a DPRK IT worker operation: laptop hosting, aged accounts, and stolen identities, observed live in one afternoon. > > [[Research/eleven-stages-five-observed-live|Read the investigation ↗]] [[Attachments/eleven-stages-five-observed-live.pdf|PDF ↓]] > >  ## Earlier investigations > [!hm-feed] > [[Research|All research ↗]] > [!hm-card] > [](Research/dprk-it-worker-operation-part-two) > > Report 02 / 13 Aug 2026 / DPRK OPERATIONS > > ### [[Research/dprk-it-worker-operation-part-two|The Identity Lifecycle]] > > An operation's own playbook for identity theft, interviews, and revenue sharing. Eleven stages, from choosing a victim to cashing out. > > [[Research/dprk-it-worker-operation-part-two|Read the investigation ↗]] > [!hm-card] > [](Research/dprk-it-worker-operation-part-one) > > Report 01 / 19 May 2026 / DPRK OPERATIONS > > ### [[Research/dprk-it-worker-operation-part-one|How North Korea Outsources Job Fraud at Scale]] > > Inside the Discord network where DPRK operators pay gig workers to submit job applications at scale. > > [[Research/dprk-it-worker-operation-part-one|Read the investigation ↗]] > [!hm-footer] > **HAYDEN MCKENZIE** · Security researcher > > [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:[email protected])