> [!hm-nav] > ** [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]] # The Identity Lifecycle, Part 2 > [!hm-meta] > Five of the eleven stages, watched running live. Over one afternoon on a public job-search Discord: $500 to host a company laptop in Texas, a hand-drawn KVM diagram, aged LinkedIn accounts for sale, and six stolen identities handed over on request. > > Hayden McKenzie · 19 Aug 2026 · Inside a DPRK IT Worker Operation > > [[Attachments/eleven-stages-five-observed-live.pdf|Download original PDF ↗]] > **Editor's note.** Observed in a public job-search Discord > over a single afternoon. No systems were accessed and no fraudulent > activity was participated in. Identifying details of the individuals > pictured, and of the employer whose offer letter appears below, are > redacted. The identity lifecycle documented in the previous report was reconstructed from an operation's own files — manuals, ledgers, contracts. Those are static artifacts. They describe a process without showing it running. In a single afternoon on a public job-search Discord, five of those eleven stages appeared in sequence, as live recruitment, from operators who were not concealing what they were asking for. What follows pairs each stage as the manual describes it against what was posted openly on the board. ## Stage 7 — Recruit an American **Then.** The archive holds a written pitch for recruiting Americans: two collaboration models, $300 a month to receive and power a company laptop, or 20–30% of income from sharing an Upwork and Payoneer account accessed over AnyDesk. **Now.** The same offer, posted openly on a job board. $500, Texas, an hour of work. I mentioned that I live in Texas, to which he responded by asking whether I knew how to install Windows. ![[Attachments/ar-1-discord-laptop-post.png|Discord post offering $500 for an hour of equipment setup in Texas.]] *The post, offering $500 on completion for roughly an hour of work, anywhere in Texas, requiring only basic computer or IT experience.* | Term | Offered | | --- | --- | | Estimated time | About 1 hour | | Pay | $500, paid on completion | | Location | Anywhere in TX | | Requirement | Basic computer or IT experience | He offered the instructions in advance, before I had expressed interest in anything. ## Stage 10 — Onboard and receive the hardware **Then.** The manual's last page lists U.S. supporters by state, and the archive documents KVM devices as a still-current form of remote access. This is the physical half of the operation. **Now.** That same hardware pattern, drawn out and handed to a prospect they had just met. I stated that I could help as long as it wasn't illegal. Rather than answer directly, he sent this diagram. ![[Attachments/ar-2-kvm-diagram.png|Hand-drawn diagram showing a company desktop connected through a TinyPilot KVM and EDID emulator to an eBay laptop.]] *Hardware KVM between the company laptop and the network. An EDID emulator so the machine believes a monitor is attached and never sleeps.* ### The install, photographed Attached to the same message: the identical install, photographed step by step, numbered, with the cables arrowed in red. ![[Attachments/ar-3-kvm-install-steps.jpg|Four numbered photographs showing each cable being connected to the KVM device.]] *Four steps: attach the Ethernet cable, insert the USB dock cable, connect the HDMI cable, plug in power.* Ethernet. USB. HDMI. Power. Written for someone who has never seen a KVM, because the person receiving it is not meant to understand it. ### The machine **Then.** Every identity in the archive carries employer credentials, pay stubs, KVM logins, and more, retained after placement so the persona can be reused. **Now.** A placement still in progress. The paperwork was signed and the start date had not arrived yet. I asked which company it was for, but he kept asking for proof of my identity. Once he started getting skeptical, I started questioning whether it was legal or not. That's when he sent me this. ![[Attachments/ar-4-offer-letter.png|Heavily redacted employment offer letter for a Senior Software Engineer position, Texas-Remote.]] *Senior Software Engineer. Texas-Remote. Dated 4 August 2026, with a start date of 31 August 2026 — four weeks after the offer.* ## Stage 6 — Build the persona **Then.** Aged LinkedIn accounts bought from a Telegram broker or a closed bidding channel, then pushed through identity verification using an emulator and a screen-captured QR code. **Now.** The same accounts, listed alongside similar fraud-related services, posted back to back as job forums on Discord fill with DPRK-related postings. Scrolling the same board I found the Texas contact on, there were dozens of other services similar to — and exactly like — the one above. ![[Attachments/ar-5-job-board-listings.png|Three consecutive job board listings seeking a laptop host, LinkedIn account providers, and an interview caller.]] *Three listings posted within an hour of each other: hosting a laptop, buying accounts, sitting interviews off a supplied profile.* Different operators, one board, one afternoon. ## Stage 1 — Choose a victim **Then.** The manual opens with who to steal: a U.S. citizen, 28 to 35, no criminal record in seven years, a common name, a developer title, and preferably no profile photo. Sourced from LinkedIn, then confirmed through a background-check service. **Now.** Potentially the same search, outsourced to strangers and priced by the head. Not identities for sale — the labour of finding them. Further down the same board, someone was not buying identities at all. They were buying the search for them. ![[Attachments/ar-6-linkedin-search-post.png|Discord post offering to pay per LinkedIn profile matching specific requirements.]] *A request for someone to search LinkedIn profiles matching specific requirements, paid per profile.* | Term | Offered | | --- | --- | | Rate | $2–$3 per profile, no negotiation | | Basis | Paid per profile, only on a perfect match | | Volume | Rate rises for whoever finds them quickly | Stage 1 of the manual, restated as a piece-rate job posting. ## Stage 8 — Apply at volume **Then.** Bidders paid $0.05–$0.10 per application and $1–$3 per interview secured, submitting against personas the buyer supplies. **Now.** Personas handed over on request, with no tests, no established trust, and no prior contact. In a separate thread, I asked a buyer if I could bid for them. After a short discussion I asked what personas I would be working from, and they provided multiple identities. ![[Attachments/ar-7-received-resumes.png|Six PDF resume files received in a chat, with names redacted.]] *Six freshly crafted resumes containing names, addresses, emails, phone numbers, and more.* The outsourced bidding market from the first report, still running, and still handing over stolen identities to anyone who asks. ## The other six stages The remaining stages were not observed on the board, but are documented in full in the identity lifecycle report. | Stage | Documented | | --- | --- | | 02 | Acquire the identity — a ledger line reading $22.50 for a single SSN | | 03 | Validate the identity — checking PII against DMV self-service portals in specific states | | 04 | Manufacture the documents — modifying PII using ID generators and AI face swaps | | 05 | Build the environment — U.S. VPS, residential proxies, shared TOTP | | 09 | Pass the interview — answer banks with personalized pronunciation guides | | 11 | Get paid, split it, cash out — payment methods and providers for acquired income | All eleven, from the operation's own files, are documented in [[Research/dprk-it-worker-operation-part-two|Part Two: The Identity Lifecycle]]. > [!hm-footer] > **HAYDEN MCKENZIE** · Independent research. Primary sources. > > [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:[email protected])