> [!hm-nav] > ** [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]] # Published investigations > [!hm-feed] > Published articles, newest first. > [!hm-card] > [](Research/eleven-stages-five-observed-live) > > Report 03 / 19 Aug 2026 / DPRK OPERATIONS > > ### [[Research/eleven-stages-five-observed-live|The Identity Lifecycle, Part 2]] > > Laptop hosting, aged accounts, and stolen identities. Five stages of a DPRK IT worker operation, observed live in one afternoon. > > [[Research/eleven-stages-five-observed-live|Read the investigation ↗]] > [!hm-card] > [](Research/dprk-it-worker-operation-part-two) > > Report 02 / 13 Aug 2026 / DPRK OPERATIONS > > ### [[Research/dprk-it-worker-operation-part-two|The Identity Lifecycle]] > > An operation's own playbook for identity theft, interviews, and revenue sharing. Eleven stages, from choosing a victim to cashing out. > > [[Research/dprk-it-worker-operation-part-two|Read the investigation ↗]] > [!hm-card] > [](Research/dprk-it-worker-operation-part-one) > > Report 01 / 19 May 2026 / DPRK OPERATIONS > > ### [[Research/dprk-it-worker-operation-part-one|How North Korea Outsources Job Fraud at Scale]] > > Inside the Discord network where DPRK operators pay gig workers to submit job applications at scale. > > [[Research/dprk-it-worker-operation-part-one|Read the investigation ↗]] > [!hm-footer] > **HAYDEN MCKENZIE** · Independent research. Primary sources. > > [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:[email protected])