> [!hm-nav] > ** [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]] # The Identity Lifecycle > [!hm-meta] > An operation's own archive — a manual on stealing an identity and surviving a background check, an interview answer bank, an expense ledger, and a signed revenue-sharing contract with an American. Eleven stages, from choosing a victim to cashing out. > > Hayden McKenzie · 13 Aug 2026 · Inside a DPRK IT Worker Operation > > [[Attachments/dprk-it-worker-operation-part-two.pdf|Download original PDF ↗]] > **Editor's note.** This investigation was conducted using open-source intelligence methods — no unauthorized access occurred at any point. The material mentioned throughout the article came from a publicly reachable file-transfer link with no access control whatsoever. Screenshots are likely redacted: SSNs, driver’s license numbers, DOBs, passport numbers, home addresses, and credentials are removed. All materials of investigative value are in the process of being referred to federal law enforcement and key details have been heavily redacted. This investigation continues *Inside a DPRK IT Worker Operation: How North Korea Outsources Job Fraud at Scale*, published May 19, 2026. Employers who believe they were impacted: [[email protected]](mailto:[email protected]). ## Investigative Methodology I hold and utilize a paid account with a legitimate, GDPR-compliant breach-intelligence platform. I queried it against an identity confirmed to be identified as DPRK-affiliated in a prior investigation. That query surfaced a sendgb.com transfer link — a mainstream file-sharing service in the same category as WeTransfer — sitting in the device’s browser history. I never accessed, connected to, or interacted with that device itself; I queried a commercial index of already-public data. Before touching the link, I confirmed it was live via urlscan.io, a standard passive check that also produced an independent, timestamped record of the link’s state. The transfer had no password, no login, and no access control of any kind — anyone holding the URL could retrieve the same files. I downloaded the contents (zip archives) into an isolated sandbox and examined them statically; nothing was executed. No credential was presented, none was requested, and no authentication or technical barrier was bypassed. Material of clear investigative value — identity documents, victim data, financial records, evidence of a physical U.S. facilitation site — is being referred to law enforcement. Everything tied to existing and future referrals was either stripped or redacted. ## How to Read This Article This article builds on work other researchers have already done well. Group-IB, Flare and IBM X-Force, Nisos, and DTEX Systems have each documented pieces of this system — personas, back-office infrastructure, organizational structure, self-funding quotas — and what follows corroborates a lot of it independently, from a different source. To supplement existing intelligence, this article details and archive involving a NK operators own training materials — a written manual on stealing an identity and surviving a background check, an interview answer bank, an expense ledger, a signed revenue-sharing contract with an American. The article is in two parts. First, a short update on what’s changed since the bidding piece I published in May — different pricing, additional services, and a few other things. Then the new intelligence: a multi-stage lifecycle walkthrough, in order, from choosing a victim to cashing out, each stage anchored to a specific document in the archive. Together, old and new techniques give a picture of how this operation runs **now** — not just a snapshot from whenever it was last written about. ## Section 1 - Continued ### What the Last Article Established In my previous article, *Inside a DPRK IT Worker Operation: How North Korea Outsources Job Fraud at Scale*, I investigated a group of DPRK IT workers who were participating in a growing trend of **outsourcing their job application process to third-party gig workers**. Incase you didn’t read my previous article, the basics of their operation included: - **Buyers** — DPRK-operated personas needing applications submitted at volume. - **Bidders** — third-party gig workers paid **$0.05–$0.10 per application submitted**, plus **$1–$3 per interview secured**, with rates set by interview yield, spreadsheet accuracy, and resume tailoring quality. - A workflow in which the bidder (typically) creates a persona’s Gmail account, configures email forwarding to the buyer’s central inbox, **tailors the resume** with ChatGPT and ResumeKit, **submits through Workday and similar systems**, and **logs everything in a shared spreadsheet** with color-coded status columns. - Payments are in **USDT over BEP20**. The main takeaways from that article were the separation of labor and their ability to avoid VPN-based detections through Workday and other applicant platforms: - The bidder **never needs to be able to impersonate a senior engineer**. They only need to submit applications at volume and configure a forwarding rule. - The buyer (or DPRK operative) can further **eliminate the risk of being flagged through talent acquisition services** (such as Workday) for using VPS or VPN infrastructure (such as Astrill). ### Notable Observations Since May #### Bidding-as-a-Service: “Bid Pro” The bidding arrangements documented in my previous article are still accurate, however, activity shows that **individuals are starting to advertise dedicated services**, marketed on the open web, **with a portfolio**, price lists, and payment terms. The greatest example of this involves **BidPro** (bidpro-ochre[.]vercel[.]app), a website hosted on a free Vercel subdomain that advertises strategic, ATS-optimized applications for clients. The operator behind BidPro labels themselves as a “Job Bidding Specialist” focused on “Reverse Recruiting” while claiming that they’ve completed 15,000+ applications and served 30+ clients. The previous article documented a market at **$0.05–$0.10 per application** with **$1–$3 bonuses per interview secured.** BidPro publishes a two-tier menu instead, priced per batch: **Normal Applications** (”standard high-quality bids”) — $10 for 100, $20 for 200/250, $24 for 300, $34 for 400, $40 for 500. Effective rate: **$0.08–$0.10/app.** **Tailored Applications** (”ATS-optimized + custom work”) — $17 for 100, $30 for 200/250, $42 for 300, $54 for 400, $65 for 500. Effective rate: **$0.13–$0.17/app.** The prices for these specialized services, especially those that recruit groups of bidders, typically seem to fall above the average rate of pay per application. The site’s “**Past Clients**” grid names fifteen clients, each with a one-line campaign blurb and a live link to a Google Sheets application log. Within these Google Sheet documents are hundreds of rows displaying companies and their associated job listing URLs, all mapped out per role and application date. ![[Attachments/p2-fig2-1.png|List of 15 different identities with publicly available Google Spreadsheets]] *List of 15 different identities with publicly available Google Spreadsheets* ![[Attachments/p2-fig2-2.png|Closer look at one of the Google Spreadsheets associated with an identity]] *Closer look at one of the Google Spreadsheets associated with an identity* A “**Proof of Work**” section adds a screenshot of a supposedly real inbox with recruiter replies and a sample application log. ![[Attachments/p2-fig2-3.png|Additional records showing how efficient they are]] *Additional records showing how efficient they are* The contact page features a WhatsApp number in the **+234** country code — Nigeria — plus a Telegram handle that's a common Yoruba surname (I will cover the significance of this shortly). > *Note: As of 8/13/2026, only eleven of the fifteen spreadsheets are still live or public. These spreadsheets include applications submitted between September 2024 and September 2025.* #### Where the Applications Come From: Kenya and Nigeria **Kenya and Nigeria** seem to be the most common countries these bidders operate out of. For a DPRK applicant, utilizing a Kenyan or Nigerian IP address is usually better than settling for a known VPS or VPN service such as Astrill. In the event a bidder mentions that they are based in the United States, most NK operatives tends to ignore the need for a bidder and requests (or sometimes begs) the would-be bidder to let them remote into their laptop or computer via Anydesk. ![[Attachments/p2-fig2-4.png|US-based bidder getting asked to collaborate differently]] *US-based bidder getting asked to collaborate differently* *Note: As an analyst, if you are viewing your companies applicant logs and notice suspicious naming conventions ([email protected], suspicious resume names) it may be worth it to check what country the IP address resolves back to (especially if you are a US-based company).* #### The Resume Says Outlook. The ATS Says Gmail. In analyzing the personas, resumes, and submission information from these Discord groups, I observed that often times, **the email on the resume PDF does not match the email used to register the applicants account in talent acquisition platforms such as Workday and Greenhouse.** The cause can partially be attributed to the account architecture documented in my last article. The Gmail account is operational: created by the bidder, forwarding to the buyer’s central inbox, used to register and submit. The Outlook address on the resume belongs to an older persona layer and is carried forward in a static document nobody re-checks. Legitimate candidates do this occasionally, however, it can be used as one of many indicators when hunting for possible DPRK applicants. ### Section Two - Identification An introduction as to how the data was obtained and what it contains. ### The Handoff #### How The Archive Was Found The process for how this data was acquired is documented in the Methodology section above; in brief, a paid query against a commercial stealer-log index, run against a device already identified as DPRK-affiliated in the previous investigation, returned a **SendGB transfer link** sitting in the devices browser history. A passive urlscan check confirmed it was live. Behind it were **zip archives** containing everything described in this article. ![[Attachments/p2-fig1-1.png|Infostealer logs displaying an active SendGB URL]] *Infostealer logs displaying an active SendGB URL* SendGB is a mainstream free file-transfer service in the same category as WeTransfer. Upload requires no account; download requires no account. Crucially, **transfers expire.** The free retention window is measured in days, not months. What makes SendGB attractive to threat actors is that file uploads can be set to **expire in a single day** (with the default expiration time set to three days). An abandoned cloud folder left open for years isn’t likely to contain important or up-to-date information, however, a file-transfer link with a retention window measured in days is essentially a handoff in progress. Somebody packaged the operation’s manuals, reports, identity documents, contracts, and financial records into zip archives and sent them elsewhere, and the only reason any of it is visible is that one machine in that exchange was infected with an infostealer. These documents aren’t just one person’s working files, they are a collection of identities, infrastructure credentials, and paperwork bundled together as a unit. This goes hand-in-hand with what [Group-IB](https://www.group-ib.com/blog/dprk-fake-remote-developers/) described in a similar assessment about the persona archive they recovered, describing it as showing how packages were assembled, maintained, and *potentially handed over between operators or working groups.* A link that dies in three days leaves no persistent or indexable artifacts. If you compare it to the archive’s other choices, such as protectedtext.com, it thrives in the fact that information doesn’t linger. #### What’s In The Archive? The zip archive contained years of accumulated material, organized by identity, by function, and by year, and bundled for delivery. **The material goes as far back as 2023 and is dated as recent as 2026.** ![[Attachments/p2-fig-06.png|Figure from the investigation]] What makes this new collection stand out is the first and the last two rows. Prior reporting has documented persona packages — [Group-IB’s Dominic Williams and Dejan Teofilovic archive](https://www.group-ib.com/blog/dprk-fake-remote-developers/) — and in [Flare and IBM X-Force’s](https://flare.io/learn/resources/north-korean-infiltrator-threat) article they discuss timesheet and “RB Site” material. In this article, however, I aim to combine that existing intelligence with new and up-to-date methods such as a thoroughly crafted job hunting document and LLC creation instructions. ![[Attachments/p2-fig1-2.png|Identities directory with a “Real Person” document]] *Identities directory with a “Real Person” document* ### Section Three - The Identity Lifecycle Eleven stages. Each is documented somewhere in this archive. *The next few parts are centered around a step-by-step document, **Job Hunting.pdf**, that details a DPRK ITW’s entire starting process and helps establish personas.* ### Stage 1 — Choose a Victim The first and most consequential page of the operation’s training manual defines what makes a stolen identity usable. The criteria are explicit: **Must be a U.S. citizen.** Green Card and H-1B holders are rejected by name. The stated reasoning is that visa status creates additional documentation, background check, and verification failure points. The manual is direct about it: most companies require citizens, and non-citizen statuses are a risk. **Must be roughly 28 to 35 years old.** The reasoning is purely commercial. A younger identity can only credibly support junior roles, and junior roles are — in the document’s own phrase — a small budget. The 28–35 band is described as optimal for the U.S. IT market. **Must have no criminal record in the last seven years.** Seven years matches standard U.S. background check lookback windows. Traffic violations and fines are explicitly noted as acceptable. In addition to these requirements, a list of preferable attributes are also listed to help find and secure reputable and profitable identities. - Search for **common American names** — *Daniel Smith* is the worked example. - Search by role: Java Developer,.NET Developer, and so on. - **Prefer profiles with no photograph.** The manual states this outright as a desirable property. - From the profile, harvest name, approximate location, work history, university, and certifications. - Then run the name through a commercial background-check service to obtain the full legal name, exact address, and criminal history — and retain the social links and location history to infer a birthplace. The entry criteria for having your identity stolen by a North Korean employment fraud operation is as simple as having **a LinkedIn profile, a common name, a developer job title, and no profile picture.** ![[Attachments/p2-s1-1.png|Screenshot from the document itself detailing requirements]] *Screenshot from the document itself detailing requirements* ### Stage 2 — Acquire the Identity The manual describes three acquisition paths and is candid about the trade-offs between them including quality complaints about criminal suppliers. **Path A — the credential broker.** A Ukraine-based broker operating as “Sergey” provides free name-and-address lookups. Additionally, driver’s license and SSN data can also be purchased from him. The manual warns that his profiles are frequently criminal-record-tainted and therefore often unusable — describes this as making him “not a good way” to source American profiles. **Path B — the “hacker.”** Two Telegram handles and one Telegram channel are given for an individual claimed to have access to U.S. government databases. Given only a full name and address, he returns DL number, SSN, DOB, and a background check PDF. **The stated price is $44.** Payment is up front. The manual describes him as trustworthy and notes he is much cheaper than the broker. **Path C — stolen license images.** A third broker supplies driver’s license photographs of real people. The manual instructs that these be checked against a background-check service, and if clean, the name, address, DL number and DOB retained — leaving only the SSN to be purchased separately from Path B. The manual’s own assessment of this route: *“This is not gentle but a good way for us.”* The market price for background information and broker payments correlate with financial records obtain from the archive. The color team expense ledger contains a single crypto line item, paid to a broker: > **SSN number — $22.50** That is what an American’s Social Security number costs in this supply chain. ![[Attachments/p2-s2-1.png|Screenshot from the document itself for obtaining identities]] *Screenshot from the document itself for obtaining identities* ![[Attachments/p2-s2-2.png|Exported document containing eleven different identities]] *Exported document containing eleven different identities* ### Stage 3 — Validate the Identity The manual instructs that all purchased identities be verified before use, and provides the verification methods. **Criminal and identity verification** runs through three named commercial background-check services: **TruthFinder**, **Intelius**, and **FastPeopleSearch**. TruthFinder requires a premium account, which the manual says to purchase from a broker at **$55/month** — with a note that this is expensive, and that a **U.S.-based supporter can obtain the same access for $25/month**. **SSN validation** runs through a public verification service such as **ssn-check[.]org**. **Driver’s license validation** runs through **state DMV self-service portals**. The manual lists ten, by state, with direct links: **Texas, Michigan, South Carolina, Alabama, New York, Kansas, Maryland, Arizona, Pennsylvania, New Jersey** ![[Attachments/p2-s3-1.png|List of DMV self-service portals and SSN validation checker]] *List of DMV self-service portals and SSN validation checker* As expected, many of these states are the some of the most targeted due to the ease of information access. ### Stage 4 — Manufacture the Documents The manual compares two options. A broker service (**trustidcard.com**) produces documents to order but is described as expensive. The recommended alternative is Russian-hosted generator website **veriftools** (oldie.veriftools.ru) which the manual describes as far cheaper and usable at any time with any photo and any information. It is important to note that since August 2025, veriftools is no longer available due to it’s domain being seized by law enforcement. The embedded screenshot of the generator’s interface shows the product catalog in a sidebar: **Passports, Driver’s License, ID Cards, Bills & Statements, USA, CIS, Facebook**. The right pane shows a rendered fake bank card, mid-generation, for a fabricated Bank of America account. ![[Attachments/p2-s1-5.png|Veriftools being used but it went extinct]] *Veriftools being used but it went extinct* Under a supplemental document, the “Photo Editor” category lists two AI face-manipulation tools: **faceswapper.ai** and **instant-portrait.com**. These are how a document photo gets matched to whoever will appear on camera — corroborating [Nisos’s](https://nisos.com/blog/inside-dprk-employment-fraud-operation/) finding that operations obtain genuine state-issued licenses and then digitally alter the photograph, and [Flare’s](https://flare.io/learn/resources/north-korean-infiltrator-threat) finding that images are run through AI editors specifically to defeat reverse image search. ![[Attachments/p2-s4-2.jpeg|Photo of drivers license (heavily redacted) before being modified]] *Photo of drivers license (heavily redacted) before being modified* ![[Attachments/p2-s4-3.jpeg|Photo of modified drivers license (note the different height and eyes listed)]] *Photo of modified drivers license (note the different height and eyes listed)* ![[Attachments/p2-s4-4.jpeg|S4.4 - Photo of another drivers license (there are dozens of them)]] *Photo of another drivers license (there are dozens of them)* ### Stage 5 — Build the Environment As mentioned previously, operatives want to avoid being flagged for using VPNs during the application process — a mention of the following reinforces that point: > **Commercial VPNs are explicitly rejected** — because job portals block them. In addition to these dated methods, the previously mentioned method of outsourcing of their job applications is another route they choose to take. In this document, the instruction is to use a **U.S.-based VPS** instead. Two providers are named and compared: - **ishosting.com** — described as having more stable IPs. - **cloudzy.com** — described as preferable for job hunting *because it bills hourly*, allowing instances to be created, reinstalled, resized, and destroyed at will. The manual states that a New York region VPS is specifically recommended. Both appear as recurring line items in the expense ledger, and both appear as credentialed accounts through multiple identity documents. ![[Attachments/p2-s5-1.png|Financial sheet displaying ishosting.com]] *Financial sheet displaying ishosting.com* ![[Attachments/p2-s5-2.png|Financial sheet displaying Cloudzy.com]] *Financial sheet displaying Cloudzy.com* The Cloudzy console shows **11 services, 11 active VPS, 7 open tickets, 10 invoices**, an account balance of $37.79, and $200.16 spent that month. Four instances are visible with names, specifications, and IP addresses: ![[Attachments/p2-s5-3.png|Cloudzy.com dashboard taken straight from manual]] *Cloudzy.com dashboard taken straight from manual* The naming convention by itself is informative. One instance is named for its function (###-proxy). One is named for a persona (RHS Alexander). The others carry three-letter prefixes consistent with initials. The ishosting.com console shows five additional servers: ![[Attachments/p2-s5-4.png|Ishosting.com dashboard taken straight from manual]] *Ishosting.com dashboard taken straight from manual* A residential proxy service, **IPRoyal**, also appears repeatedly in the ledger — including a $47 entry described as a broker fee **for passing identity verification**, and a $20 entry for restoring a suspended account. The manual recommends **Gmail** over other mail alternatives for ease of maintenance, with the requirement that account creation be performed **from the VPS or a U.S.-located machine**. > *Note: As of mid-2026, there seems to be an increasing trend of NK operatives choosing Outlook over Gmail.* The manual explicitly rejects **Google Voice** for **phone numbers** on the stated grounds that *recruiters recognize it as a virtual number immediately*. **Skype** was recommended instead; the manual concedes Skype is also virtual but assesses that it draws less suspicion. Similar to the previous instruction, Skype is no longer active and therefore no longer attractive for NK operatives — newer documentation and browsing history suggest a strong preference to **slynumber.com** and **hushed.com**. In the past, NK operatives had their Skype numbers funded through crypto gift-card gateway **CoinGate**, paid in **USDT on Binance Smart Chain**, and redeemed for Skype credits. It appears that CoinGate is still used by operatives for other crypto-related purchases, however, Skype is no longer included in that. In addition, when using the site, the billing address entered must match the city of the VPS IP — the manual’s example: if the VPS is New York, enter a New York billing address. > *Note: If you apply these tactics to newer phone services, much of the process stays the same.* **Additional service providers** mentioned in the manual include: - **SMS verification services** — *sms-man.com*, *sms-activate.org* — for phone-verifying accounts at scale. - **Temporary email** — *mailforspam.com* — used as the secondary verification address when creating Gmail accounts. - **TOTP generation** — *2fa.live* — browser-based 2FA code generation, meaning MFA secrets are shared across a team rather than bound to a device. - **AirDroid** — remote control of a physical Android device from a computer. - **A dedicated server**, per the ledger, at $100, annotated as being **“for MFA and zoom session and emulator.”** One machine consolidating multi-factor authentication, interview calls, and the Android emulator. ![[Attachments/p2-s5-5.png|A list of services and their credentials]] *A list of services and their credentials* ### Stage 6 — Build the Persona The manual advises focusing each persona on a **single tech stack**, with two named archetypes: - **Java** — Spring Boot + AWS + Angular, padded with some Go and Python. - **C#** —.NET + React + Azure DevOps. For backend roles, emphasize DevOps and microservice architecture. ChatGPT and Claude are recommended for drafting, with a warning that the technical content must actually be correct. Resumes are built on **FlowCV** — a $70 annual line item in the ledger. Aged LinkedIn accounts are purchased from either a broker on Telegram or through bidding-focused Discord channels. The problem is that editing name, location, summary, and experience triggers LinkedIn’s identity verification challenge and can restrict or block the account. The manual’s solution to that is centered around capturing the verification QR code from the screen using **ShareX**, redirecting the challenge into **LDPlayer** (an Android emulator), and supplying a passport image to the verification vendor **through screen capture rather than a physical camera**. ![[Attachments/p2-s6-1.png|ShareX dashboard]] *ShareX dashboard* ![[Attachments/p2-s6-2.png|QR code scanning through ShareX]] *QR code scanning through ShareX* ![[Attachments/p2-s6-3.png|Additional instructions for identification verification]] *Additional instructions for identification verification* 1. Any verification flow that offers a “capture from screen” fallback is exposed to the same technique. The manual lists **VCAM** and **OBS** under a heading explicitly noting they should be used *instead of* a camera, with QR scanning as the example. 2. The manual admits the bypass is unreliable and states that using a real person’s genuine ID achieves a 100% pass rate. 3. After one real job, the persona verifies LinkedIn with the corporate email address. Every successful placement permanently legitimizes the persona for all future applications. The manual adds one more piece: the **Cookie-Editor** Chrome extension, listed specifically for importing LinkedIn session cookies. That means an authenticated LinkedIn session can be moved between machines and operators without ever re-authenticating which makes a persona’s LinkedIn presence portable across a team. ![[Attachments/p2-s6-4.png|Highlighted tools associated with LinkedIn and camera verification]] *Highlighted tools associated with LinkedIn and camera verification* ![[Attachments/p2-s6-5.png|LinkedIn profile used in the instruction manual]] *LinkedIn profile used in the instruction manual* ### Stage 7 — Recruit an American (Optional) Everything to this point can be done from abroad. Sure, there are tons of operatives who avoid U.S. based operations due to the strict requirements, however, that’s where a majority of the money is made — and they know it too. The hesitation to focus on U.S. operations is due to the fact that their identities often require someone to physically receive a laptop, appear on camera, sign an I-9, or hold a U.S. bank account. For that the operation needs an American and the manual contains one of many pitches used to recruit them. This stage has also become dramatically more important to the operation than it once was after an identity broker this network relied on was seized and arrested in May 2024. The strategy shifted away from buying stolen identities and toward recruiting real, willing Americans — whose own term for such a person, in their communications, is a *“real guy.”* In a document, written in the first person, there are two options when pitching collaboration ideas to a potential American prospect: #### Collaboration 1 (Identity) The recruit is asked to: 1. Keep a PC powered on and allow the operator to **connect remotely 24/7**. 2. Create an **Upwork account in their own real identity**. 3. Create a **Payoneer or PayPal account**. The stated reason is explicit and revealing: *Upwork tracks IP addresses, and an account created from another country will be blocked.* The author states his own location plainly — **Singapore**. The operator then bids on projects using the recruit’s Upwork account, performs the work, withdraws earnings to the recruit’s Payoneer or PayPal, and pays the recruit **20% of total income**. There is a tiered upsell: **30% if the recruit is willing to appear in video meetings** — with a parenthetical noting that in that case, the recruit should know something about IT. The pitch closes this section with a line that is almost a slogan: *in this way, you can earn the money without the sweat.* ![[Attachments/p2-s7-1.png|First listed collaboration method]] *First listed collaboration method* #### Collaboration 2 (Hardware) Described as simpler. The author says he has **many friends who bid on US remote jobs**, met on social networks. U.S. companies ship equipment — PC, iMac, printer. The recruit provides their address, receives the equipment, keeps it powered on, and allows remote connection. **$300 per month, per job.** That figure matches [Nisos’s](https://nisos.com/blog/inside-dprk-employment-fraud-operation/) finding precisely: facilitators recruited through Reddit, Discord, and adult cam sites, offered 50/50 salary splits or $300 payments. #### Referrals (Tell a friend!) The document closes by asking the recruit to refer **reliable friends**, noting it would be beneficial if they had software development knowledge, and signing off as *a senior software engineer* who can assure good earnings in exchange for strong support. ![[Attachments/p2-s7-2.png|Second collaboration method]] *Second collaboration method* ### Stage 8 — Apply at Volume Several job boards are named including **LinkedIn, Indeed, Dice, Glassdoor, SimplyHired, ZipRecruiter, and CareerBuilder.** The **LazyApply** Chrome extension is purchased at roughly **$170**, which the manual claims supports **750 applications per day across five profiles**. The manual also instructs that LinkedIn should not be used for bidding — only as a profile — because its policy enforcement is strict. And then there is the exclusion, which is interesting in it’s own way: > *Do not bid on public trust or security clearance jobs. You cannot pass the background check. These are government jobs — do not bid on them.* Federal roles appear to be off the target list — which would be somewhat surprising given the recent report that a [North Korean IT worker spent months at at US federal agency](https://cybernews.com/security/north-korea-it-worker-us-federal-agency/). Additional artifacts prove that guidance regarding federal roles serve as more of a suggestion given one of the persona’s included in the archive includes a.gov email address. ![[Attachments/p2-s8-1.png|Exposed.gov credentials and PiKVM login]] *Exposed.gov credentials and PiKVM login* Between the manual’s 100/day manual floor, the bot’s claimed 750/day ceiling, and the outsourced bidder network mentioned earlier in the article, application volume is an important aspect of the operation. [Nisos](https://nisos.com/blog/inside-dprk-employment-fraud-operation/) measured a comparable cell at **170,000 applications across 22 operatives in ten months, yielding 76 offers** — a 0.35% conversion rate. ![[Attachments/p2-s8-2.png|Bidding spreadsheet]] *Bidding spreadsheet* ![[Attachments/p2-s8-3.png|Packaged identities for spam applications for]] *Packaged identities for spam applications for* ### Stage 9 — Pass the Interview An all inclusive **40-item index** — a self-introduction, a named flagship project, then behavioral and technical questions followed by fully written answers to each. Three details make this far more valuable than its contents suggest. #### It is written to be read aloud Embedded at intervals in the prose are **phonetic pronunciation guides in dictionary notation**, attached to exactly the words a non-native English speaker would stumble on. They appear inline, mid-sentence, in otherwise ordinary answers: > *“I also have a knack /nak/ for optimizing performance…”* *“…allowing frontend and backend teams to work more autonomously /əˈtänəməslē/.”* *“…strengthened my technical acumen /əˈkyo͞omən/…”* *“…exceed expectations and achieve /əˈCHēv/ excellence…”* It explains one of the most commonly cited DPRK interview red flags as [Group-IB](https://www.group-ib.com/blog/dprk-fake-remote-developers/) lists *“inconsistent English fluency that fluctuates during the call”* as a warning sign. #### The interview is not necessarily the person The manual contains an entry that changes how any video interview should be read. Under a heading about calls on a remote laptop, it describes using **Voicemeeter Banana** — a virtual audio mixer — to route voice between a remote laptop and a local one, by joining the same meeting from both machines and setting both the meeting client and the conferencing application to use the virtual audio device. This is how a person in one country can speak through a video call that a person in another country appears to be attending. [Nisos](https://nisos.com/blog/inside-dprk-employment-fraud-operation/) documented this pattern behaviorally — a U.S.-based “native” on camera while the operative supplies technical answers remotely via KVM. This is the configuration guide for it. Combined with the virtual camera tooling from Stage 6, a single video call can have **one person’s face, another person’s voice, and a third person’s hands on the keyboard.** ![[Attachments/p2-s9-1.png|Methods used to bypass interview restrictions]] *Methods used to bypass interview restrictions* ### Stage 10 — Onboard and Receive the Hardware Once an offer lands, the physical issues arise as a laptop must be shipped to a U.S. address, and someone must sign an I-9. The *Job Hunting* manual’s final page addresses this directly as it lists a handful of known **U.S. supporters** based in a few different states. ![[Attachments/p2-s10-1.png|Heavily redacted list of U.S. facilitators]] *Heavily redacted list of U.S. facilitators* ![[Attachments/p2-s10-2.png|Another heavily redacted list of U.S. supporters]] *Another heavily redacted list of U.S. supporters* Once the hardware arrives, remote access is established. The next few sections will detail many of the logistical issues and bypass methods used to make this process easier. ![[Attachments/p2-s10-3.png|Photo for a specific identity documenting RustDesk compatibility]] *Photo for a specific identity documenting RustDesk compatibility* ### Stage 11 — Get Paid, Split It, and Cash Out The money is covered in depth in Part Three. In summary, the chain runs: 1. The employer’s payroll deposits the salary into an account created in the persona’s or facilitator’s name. 2. The split is executed per a revenue-sharing contract — 50/50, 70/30, with the facilitator’s 15–25% coming from the intermediary’s share. 3. The funds are then moved out of the traditional banking system. The ledger shows conversion into payment platforms with broker and bank withdrawal fees due to their movement across **BEP20, TRC20, ERC20, Polygon, and Arbitrum**. 4. The ledger repeatedly references an Ethereum address for the “Color team,” identified in descriptions only by its final characters. In the next section, newer mechanisms and services are mentioned which allow for easier and more reliable payouts. ![[Attachments/p2-s11-1.png|Payments associated with crypto expenses and conversions]] *Payments associated with crypto expenses and conversions* ## Section Three - Diving Deeper ### Identity Architecture #### Centralized identity documentation The bulk of their documentation contains per-identity files or directories which could be anywhere from a group of.txt files and pictures to massive OneNote pages. In a notable number of cases, a link **protectedtext.com** — a free, password-protected plaintext note service requiring no additional verification, is used to distribute identities to anyone. The person who runs the interview, the person who receives the laptop, and the person who does the work may be three different people in three countries who need the same reference sheet and cannot be trusted with a shared account. A password-protected URL is the ideal solution for this type of operation. Each identity used is then sorted and documented in great detail containing personal and professional artifacts for reuse such as: - Full legal name, date of birth, and SSN - Altered driver’s license and/or passport with scans - Address of record — plus, separately, the shipping address actually used - Current and historical phone numbers, typically VoIP - Email credentials, its recovery address, and the forwarding target - KVM login credentials — device address, username, password - VPS access — provider, IP, credentials - Specific proxy configurations - Employer-specific credentials for jobs already landed - Pay stub records and direct deposit details - Which personas serve as this persona’s references ![[Attachments/p2-fig3-1-1.png|Extensive identity documentation]] *Extensive identity documentation* ![[Attachments/p2-fig3-1-2.png|Supplemental information for an identity]] *Supplemental information for an identity* #### They use each other as references A persona’s listed professional references are, in multiple observed cases, **other personas in the same collection.** When a hiring team calls to verify prior employment, the call is answered by the operator running another persona. [Nisos](https://nisos.com/blog/inside-dprk-employment-fraud-operation/) documented the same structure. What this section adds is the bookkeeping aspect of the references as each one is predetermined and assigned in advance. ![[Attachments/p2-fig3-1-3.png|Designated references listed under identity profile]] *Designated references listed under identity profile* > *Note: A company that quietly terminates a suspected DPRK worker without reporting it has handed the operation a legitimate reference.* #### Background checks on real people As previously mentioned, background checks are typically ran on real people to verify their identities and to make sure their background is clear. The standard output of the three consumer services named in the manual typically contain: - Address history going back years - Relatives and known associates, with ages and locations - Vehicle registrations - Employment and education history - Current and historical phone numbers - Court and civil records where present The manual describes this part of the process as “*important*” an emphasizes being able to answer questions about where they grew up or went to school — this is precisely the rapport-building question [Group-IB](https://www.group-ib.com/blog/dprk-fake-remote-developers/) recommended interviewers use to catch inconsistencies. The exposure for victims also extends well past their own identity. **Their family members are in these files.** ![[Attachments/p2-fig3-1-4.png|Identity folder]] *Identity folder* ![[Attachments/p2-fig3-1-5.png|Identity folder separated into family members]] *Identity folder separated into family members* ![[Attachments/p2-fig3-1-6.png|PII associated with a victims family member]] *PII associated with a victims family member* > *Note: Even though many of these identities are stolen, a surprising amount of them are willingly given to the NK operator — documentation shows dozens of individuals were willing to recording videos of themselves, file LLCs, and assist throughout the hiring and banking processes of the operation.* ### Infrastructure and Remote Access #### CCProxy CCProxy is a Windows proxy server marketed to small offices for sharing a single internet connection. The archive’s configuration guide walks through installing it on a U.S.-region VPS (or, in some documentation, on a supporter’s home machine) and enabling HTTP and SOCKS5 with per-user authentication (used for proxy chaining). Operators abroad then point their browsers and applications at that host, and every request they make egresses from one U.S. IP. The effect is that a team spread across multiple countries presents to an employer, a job board, or an identity verification vendor as a single user sitting at a single American address. It also gives them a cheap second hop in front of the residential proxy layer: traffic can be chained from the operative, through CCProxy on the VPS, out through IPRoyal, and arrive looking like a consumer broadband connection near the victim’s address of record. ![[Attachments/p2-fig3-2-1.png|Image of CCProxy settings]] *Image of CCProxy settings* #### Remote Access Patterns The artifacts contained dozens of photographs detailing **PiKVM** device usage — a well-known indicator of potential DPRK activity. Photographic and documentary evidence indicates PiKVM devices are still being heavily used in 2026. ![[Attachments/p2-fig3-2-2.png|Documented PiKVM usage]] *Documented PiKVM usage* Alongside the hardware approach, the operation can use a software approach such as **RustDesk, AnyDesk, and TeamViewer** — all notable remote desktop tools. When these methods are blocked, or when the operator fears detection by using these methods, evidence shows common attempts to bypass detection by using **Webex** and **Zoom** — common and typically approved services across large enterprises. ![[Attachments/p2-fig3-2-3.png|I’m not sure why they screenshotted their conversations, and I clipped some of the conversation out, but this discusses bypass methods via software]] *I’m not sure why they screenshotted their conversations, and I clipped some of the conversation out, but this discusses bypass methods via software* ![[Attachments/p2-fig3-2-4.png|Discussion on using Webex as a work-around]] *Discussion on using Webex as a work-around* ![[Attachments/p2-fig3-2-5.png|Discussion on using Zoom via Mac as a work-around]] *Discussion on using Zoom via Mac as a work-around* If your company does not block Zoom or it’s remote-control feature, a network indicator that occasionally presents itself is the file *saveUserDisclaimer* — typically observed when a feature being utilized within the meeting requires user acceptance. If you want to dive deeper into Webex logs for this activity, I advise you to check out [Grumpy Goose Labs](https://blog.grumpygoose.io/web-exploitation-712cdeb8ecf0) article detailing their successful identification of remote-control logs from the application. They also provide a helpful guide which discusses methods to [identity KVM usage](https://blog.grumpygoose.io/be-kvm-do-fraud-8ab523d26c9d) across an enterprise. > *Note: In the event NK operators refuse to use remote-control access and opt for screen-sharing methods, look for excessive Zoom or Webex usage across multiple days, on weekends, or outside of typical work hours.* ### Payment Records and Documentation #### Documented financial processes For each successfully used identity, there is a complete and organized financial history documented for payment tracking and future verification. The payments associated with one identity may need to be split amongst teams, facilitators, and other groups that assisted in onboarding and maintaining access for an identity. Additionally, a pay stub is proof of employment. It supports the next application, the next background check, the next account opened in that identity’s name. ![[Attachments/p2-fig3-3-1.png|A list of financial and payment documents]] *A list of financial and payment documents* As a complimentary aspect, many operators document every thing resume they’ve created and organize it by company and role — combining these files makes future operations run smooth. ![[Attachments/p2-fig3-3-2.png|These companies were only applied to and not verifiably infiltrated, these files only document resumes for future use]] *These companies were only applied to and not verifiably infiltrated, these files only document resumes for future use* Among the new methods of separating and facilitating payments, a prepared script for the platform **HuruPay** was observed within the archive. ![[Attachments/p2-fig3-3-3.png|Though HuruPay is not explicitly used here, pay stubs like these are documented regardless of payment type for every identity]] *Though HuruPay is not explicitly used here, pay stubs like these are documented regardless of payment type for every identity* **HuruPay** is used to receive bi-weekly salaries from an employer as part of regular payroll payments. HuruPay provides **stablecoin-backed virtual USD, EUR, and GBP accounts** aimed at freelancers, remote workers, and businesses in Africa and other emerging markets — explicitly marketed, in the company’s own app store listing, as letting you *receive USD payments with a US account, even if you’re not a US resident.* It supports 50+ countries including Nigeria, Ghana, South Africa, the Philippines, and the United States, and allows near-instant off-ramping to stablecoin wallets, local banks, and mobile money. [Group-IB’s](https://www.group-ib.com/blog/dprk-fake-remote-developers/) guidance to employers is to pay salaries only into licensed, deposit-accepting institutions, and to prohibit pooled accounts, e-wallets, and remitters. ### LLC Formation and the Corp-to-Corp In great detail, and with tons of supplementary paperwork and instructions, lays the instructions for creating a LLC and what purpose it serves. Alongside the interview scripts and the identity manual, the archive contains a short plaintext file — a step-by-step guide to filing a Texas LLC through SOSDirect, the Secretary of State’s online filing portal. Those documents also contain a completed filing package for a Texas LLC, formed in October 2025. - Create a SOSDirect client account; credentials arrive by email. - Pre-fund the account so filings can be paid for. - Submit the Certificate of Formation (Form 205) — entity name, address, registered agent, organizer, purpose, management structure. - Pay $300. - Wait for the stamped certificate. - Then: obtain an EIN from the IRS, draft an operating agreement, open a business bank account, and handle Texas franchise tax. In documented exchanges with other NK operatives, discussions rose asking whether forming an LLC in the U.S. requires a “real guy” — the term Section 7 established for a willing American collaborator. One of the operatives then explain why an LLC would be needed: he wants to try a **CTC role**. CTC is corp-to-corp — in a corp-to-corp engagement, the client does not hire a person; the client contracts with a company, and that company supplies the worker. What the client collects is not an I-9 and a driver’s license but a certificate of formation, a W-9, a certificate of insurance, and bank details. Employment-track identity controls do not fire, because there is no employment. - The peer notes that his **team manager’s real guy has his own company**, and that a teammate secured a CTC role through it — meaning an existing American-owned entity can be reused rather than formed fresh. - He describes a volume of available project opportunities through that channel. - Asked whether the work is in the U.S., the reply is that the American then **needs to be added into the LLC**. That last point deserves emphasis. The LLC is not built around the operative and then handed to an American. It is built around the American — his name, his address, his signature, his tax status — and the operative is added afterward. ![[Attachments/p2-fig3-4-1.png|Documentation for the creation of, and to maintain, existing LLCs]] *Documentation for the creation of, and to maintain, existing LLCs* ![[Attachments/p2-fig3-4-2.png|A documented discussion (I guess a reminder?) on why LLCs are useful and what is needed to obtain one]] *A documented discussion (I guess a reminder?) on why LLCs are useful and what is needed to obtain one* In addition to filing documentation and instructions, written contracts for multiple shell companies were observed within the archive. ![[Attachments/p2-fig3-4-3.png|Contract associated with a NK shell company detailing specific conditions]] *Contract associated with a NK shell company detailing specific conditions* The details provided in the contract are consistent with historical shell companies and the payment models used correlate with existing fraudulent remote work prices. #### Historical Corroboration - In a **June 2025 coordinated action**, DOJ described U.S. facilitators Kejia Wang and Zhenxing Wang standing up shell companies — **Hopana Tech LLC, Tony WKJ LLC, and Independent Lab LLC** — with matching websites and financial accounts, specifically to make overseas IT workers appear affiliated with legitimate U.S. businesses. Kejia Wang was sentenced to 108 months; Zhenxing Wang to 92 months. Nine co-defendants charged in the same action remain at large, with a State Department reward of up to $5 million outstanding. ## Section Four - What Else? ### Who is our new friend? According to documentation and chat logs, our NK operator goes by the name of “spring day” and goes by the initials RJM. There weren’t enough details to map out their full name, however, I was able to note that he manages a team of three and was born on 03/06/2000. There were a few teams our friend may have been associated with, these had names such as *Color Team* and *Team Dev Money*. In his free time, he loves to play Counter Strike. You shouldn’t be surprised to find out that there are dozens, maybe hundreds, of photos of our friend within the archive. ![[Attachments/p2-fig4-1-2.jpeg|NK Photo #1]] *NK Photo #1* ![[Attachments/p2-fig4-1-3.png|NK Photo #2]] *NK Photo #2* ![[Attachments/p2-fig4-1-4.png|NK Photo #3]] *NK Photo #3* ### The Didenko Indictment (Relevance) On May 16, 2024, the Justice Department seized upworksell.com and diverted its traffic to the FBI. The site was operated by Oleksandr Didenko, a Kyiv resident who also used the name “Alexander Didenko,” and it functioned as a storefront for exactly what Stage 2 describes: stolen U.S. identities and pre-built freelance platform accounts, sold or rented to overseas IT workers. Polish authorities arrested him; he was extradited to the United States on December 31, 2024. He pleaded guilty on November 10, 2025 to wire fraud conspiracy and aggravated identity theft, and in February 2026 was sentenced to 60 months in prison, 12 months of supervised release, forfeiture of more than $1.4 million, and roughly $46,500 in restitution. Didenko managed as many as 871 proxy identities and created more than 2,500 fraudulent accounts across freelance job platforms, money service transmitters, email providers, and social media. His clients obtained work at more than 40 U.S. companies. He also paid U.S. residents to receive and host company hardware, operating at least three laptop farms across California, Tennessee, and Virginia — and in late 2023, at a customer’s request, shipped a computer to the Arizona laptop farm run by Christina Chapman, who was arrested the same month his domain was seized and later sentenced to 102 months. In the archive, Didenko is mentioned as a reliable broker associated with the fraudulent identity gathering and verification. After Didenko was arrested, discussions arose between operatives detailing changes in their preferences. ![[Attachments/p2-fig4-2-1.png|Documented discussion (presumably for instructions) on what not to do]] *Documented discussion (presumably for instructions) on what not to do* > *Note: Upworksell sold freelance-platform accounts. The current model now prefers direct employment or corp-to-corp vendor contracts using reliable American facilitators.* ### Identity Verification Methods (Tips) A weak but occasionally useful check: pull a suspicious applications address into **Google Street View**. A recurring pattern across addresses tied to these applications — shipping addresses, registered office addresses on entity filings, addresses of record on resumes — is that the property is blurred out in Street View, or the address resolves to a strip-mall suite, a mail center, or a virtual office shared with a long list of thinly documented LLCs. Neither is evidence of anything on its own. Blur requests are free, take minutes, and are made by ordinary homeowners for ordinary privacy reasons. ## Notable IOCs and TTPs Every service, site, platform, and application named anywhere in this article. ### Victim selection and identity acquisition - **LinkedIn** — Primary victim-sourcing pool. Search by common American name and developer job title; profiles without photographs are explicitly preferred. - **TruthFinder** — Background report on the selected victim. - **Intelius** — Same function: address history, relatives, employment, court records. - **FastPeopleSearch** — Same function; free tier used for initial confirmation. - **Telegram** — One of their main communication channels; used for contacting brokers, facilitators, etc. - **upworksell.com** — Historical. Didenko’s marketplace for stolen identities and pre-built freelance accounts; seized May 16, 2024. ### Identity validation - **State DMV self-service portals** (TX, MI, SC, AL, NY, KS, MD, AZ, PA, NJ) — Confirm a purchased driver’s license number is live and matches the name before spending money on documents. - **Public SSN validation services** (e.g. ssn-check[.]org) — Confirm a purchased SSN is structurally valid and issued. ### Document fabrication and photo manipulation - **oldie.veriftools.ru** — Russian-hosted generator for passports, driver’s licenses, ID cards, and bills/statements. Domain seized in August 2025. - **trustidcard.com** — Broker producing documents to order; described in the manual as the expensive option. - **faceswapper.ai** — Match a document photograph to whoever will appear on camera. - **instant-portrait.com** — Same; also used to defeat reverse image search on persona photos. ### Network infrastructure - **cloudzy.com** — U.S.-region VPS, billed hourly so instances can be created and destroyed at will. - **ishosting.com** — U.S. and Canada VPS, preferred where a stable long-lived IP is needed. - **IPRoyal** — Residential proxy. - **CCProxy** — HTTP/SOCKS proxy on a VPS or supporter machine. - **Astrill VPN** — VPN provider. - **Windscribe VPN** — Same role, secondary. - **Hostinger** — Domain registration and hosting (also used for mailbox infrastructure). - **Vercel** — Free subdomain hosting. - **bidpro-ochre[.]vercel[.]app** — Bidding-as-a-service storefront: batch pricing, client list, live Google Sheets application logs (is not directly associated with the DPRK) ### Accounts, phone numbers, and verification - **mailforspam.com** — Disposable secondary address during Gmail account creation. - **sms-man.com** — SMS verification numbers at scale. - **sms-activate.org** — Same. - **2fa.live** — Browser-based TOTP generation. MFA secrets shared across a team rather than bound to a device. - **Skype** — Historical persona phone numbers and broker contact; assessed as drawing less suspicion than Google Voice. Now defunct. - **slynumber.com** — Current phone number replacement for Skype numbers. - **hushed.com** — Same. - **Google Voice** — Explicitly rejected form of VoIP phone numbers. - **AirDroid** — Remote control of a physical Android handset from a computer. - **LDPlayer** — Android emulator used to redirect ID verification challenges away from a real camera. - **ShareX** — Screen capture of verification QR codes for redirection into emulator. - **VCAM** — Virtual camera. - **OBS** — Recording software with same role as VCAM. - **Persona** (inquiry.withpersona.com) — Identity verification vendor. - **Cookie-Editor** (Chrome extension) — Import LinkedIn session cookies so an authenticated session moves between machines and operators without re-authenticating. - **protectedtext.com** — Free password-protected plaintext notes. - **OneNote** — Per-identity dossiers in the archive. - **SendGB** — Free file transfer with a retention window measured in days. ### Persona construction and application - **FlowCV** — Resume builder. - **ChatGPT** — Resume drafting, tailoring, and interview answer generation. - **Claude** — Same, named alongside ChatGPT in the manual. - **ResumeKit** — Per-application resume tailoring in outsourced bidder workflow. - **LazyApply** (Chrome extension) — Bulk application bot. - **Workday** — ATS submission target. IP-aware, which is why VPNs are rejected. - **Greenhouse** — ATS submission target. - **Indeed, Dice, Glassdoor, SimplyHired, ZipRecruiter, CareerBuilder** — Named job boards for volume application. - **LinkedIn** — Shares an individuals current and historical employment history. - **Google Sheets** — Shared application logs with color-coded status columns, between buyer and bidder. - **Discord** — Bidder recruitment and coordination; also a source of aged LinkedIn accounts. - **WhatsApp** — Documented channel of communication. - **Reddit and adult cam sites** — Facilitator recruitment channels documented by Nisos. ### Interview and presence - **Voicemeeter Banana** — Virtual audio mixer routing one person’s voice into a call another person appears to be attending. - **Zoom** — Interviews; also abused for remote control where enterprise policy permits it. - **Webex** — Video conferencing tool used for remote control and screen sharing. - **Google Meet** — Another viable option for abusing remote control and screen sharing. - **Excalidraw** — Whiteboarding during technical interviews. ### Remote access to employer hardware - **PiKVM** — Hardware KVM on the employer-issued endpoint. - **AnyDesk** — Remote access software. - **RustDesk** — Same, open-source alternative. - **TeamViewer** — Same. - **Google Remote Desktop** — Same. ### Entity formation and contracting - **Texas SOSDirect** — Online filing portal for the Certificate of Formation (Form 205). - **IRS online EIN application** — Federal tax ID assigned immediately after formation, enabling a business bank account. - **Upwork** — Freelance platform. Accounts created in a real American’s identity because the platform tracks IP. ### Payments and cash-out - **HuruPay** — Stablecoin-backed virtual USD/EUR/GBP accounts marketed to non-U.S. residents. Receives bi-weekly payroll and off-ramps near-instantly. - **Payoneer** — Withdrawal target for Upwork earnings held in the recruit’s real name. - **PayPal** — Same. - **CoinGate** — Crypto-to-gift-card gateway. - **Binance** — Exchange and BSC on-ramp. - **USDT** (BEP20, TRC20) — Primary settlement asset for bidder payments and broker fees. - **USDC, ERC20, Polygon, Arbitrum** — Additional rails visible in the ledger for splitting and moving proceeds. ### MITRE ATT&CK Mapping - **T1589.001 — Gather Victim Identity Information** Written victim selection criteria; LinkedIn name-and-role sourcing; background report acquisition. - **T1585.001 — Establish Accounts: Social Media** Purchased and laundered LinkedIn accounts; purchased Facebook accounts. - **T1586 — Compromise Accounts** Aged LinkedIn account takeover; session cookie portability. - **T1588.007 — Obtain Capabilities: Artificial Intelligence** ChatGPT for resumes and answers; AI face-swap tooling. - **T1583.003 — Acquire Infrastructure: Virtual Private Server** Cloudzy and ishosting U.S.-region instances. - **T1583.008 — Acquire Infrastructure: Malvertising/Proxy** IPRoyal residential proxies; CCProxy chaining. - **T1199 — Trusted Relationship** Employment as the access vector; intermediary LLC contracting. - **T1078 — Valid Accounts** Employer-issued credentials retained in dossiers. - **T1219 — Remote Access Software** RustDesk, AnyDesk, Google Remote Desktop. - **T1200 — Hardware Additions** PiKVM on employer-issued endpoints. ### Honorable Mention I would like to shout out a friend of mine, [Jeff Meendering](https://www.linkedin.com/in/jeffmeendering/), who built specialized tools to assist in automated data collection and correlation efforts. It would have taken a lot longer to parse through this information if it weren’t for him. ### Prior Reporting This investigation builds on and corroborates published work by other researchers. Anyone working this problem should read all of it: - **Hayden McKenzie**, *Inside a DPRK IT Worker Operation: How North Korea Outsources Job Fraud at Scale* — the outsourced bidder network, per-application and per-interview pricing, the Gmail forwarding architecture, and the AI-assisted submission workflow. - **Group-IB**, *[Uncovering the DPRK’s fake remote developer ecosystem](https://www.group-ib.com/blog/dprk-fake-remote-developers/)* — persona archives, identity reuse across GitHub and portfolio infrastructure, the service stack behind a synthetic developer identity, and the most usable set of HR, finance, and security mitigations published to date. - **Flare Research and IBM X-Force**, *[Inside the North Korean Infiltrator Threat](https://flare.io/learn/resources/north-korean-infiltrator-threat)* — internal DPRK back-office platforms (RB Site, NetkeyRegister), NetKey/OConnect, IP Messenger, timesheet and ranking systems, Astrill VPN use, and the Google Translate tradecraft underpinning daily work. - **Nisos**, *[Inside a DPRK Employment Fraud Operation](https://nisos.com/blog/inside-dprk-employment-fraud-operation/)* — organizational hierarchy, 170,000 applications to 76 offers, facilitator recruitment channels and pricing, AI-assisted interviewing, and the three revenue models. - **DTEX Systems**, *[Exposing DPRK’s Cyber Syndicate and Hidden IT Workforce](https://reports.dtex.ai/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf)* — organizational structure, self-funding quotas and the sub-20% earnings retention figure, the IT worker ecosystem role map, cross-employer bastion access, and rare operational imagery. *If you believe your organization may have employed one of these individuals, or if you have information relevant to this investigation, reach out at [email protected].* > [!hm-footer] > **HAYDEN MCKENZIE** · Independent research. Primary sources. > > [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:[email protected])