North Korea has been infiltrating IT workers with fake identities into Western companies for years, and now we know exactly how they do it. A cybersecurity researcher known as SttyK obtained a database that reveals the inner workings of this operation. The files, shared with Wired, include dozens of gigabytes of data and thousands of emails.
What the Leaked Database Reveals
The database shows a highly organized structure of workers divided into twelve groups, each with about twelve members. They report to a single “master boss.” This is not a loose network of freelancers; it is a disciplined, hierarchical organization.
Find Original Home Decor sparking conversation at Grand Goldman Shop.
The group uses Slack for communication, along with Google accounts, GitHub, and spreadsheets. These spreadsheets track jobs and progress toward financial and strategic goals. They even record the specific job requirements (such as programming languages) of target companies and their locations, along with whether contact has been made and the status of each application.
How the Infiltration Works
The scheme is methodical. Workers create fake identities and apply for remote IT positions at companies in the United States and Europe. Once hired, they receive salaries that are funneled back to North Korea to fund its nuclear program, according to the FBI, the Department of Justice, and Google.
The operation has evolved over time. As the United States became more hostile, the actors shifted their focus to Europe. The leaked data shows they keep detailed records of which companies have been approached and which positions are most promising.
Why This Matters for Businesses
This infiltration poses serious risks. Companies unknowingly hire individuals who are not who they claim to be. Beyond the financial loss, there are security risks: these workers may have access to sensitive data and systems.
The scale of the operation is significant. With twelve groups of about twelve members each, that is roughly 144 workers, though the actual number could be higher. The use of spreadsheets to track job applications and progress indicates a level of planning that is often underestimated. The background to this story is set out in Fake Election Polls Exposed: 21-Year-Old Behind Viral Scheme. A related thread runs through Dyfed-Powys Police Cyber-Attack: Staff Data Security Breach. Earlier coverage in OpenAI Warns of Persistent AI Cyber-Attacks and Security Risks shows how the argument developed.
Key Takeaways for Employers
- North Korea uses fake identities to place IT workers in Western companies.
- The operation is organized into twelve groups with a hierarchical structure.
- Workers use Slack, Google accounts, GitHub, and spreadsheets to coordinate.
- Salaries are funneled back to North Korea to fund its nuclear program.
- Companies should strengthen background checks for remote hires.
Comparison of Infiltration Tactics
| Tactic | Description | Risk Level |
|---|---|---|
| Fake identities | Workers pose as legitimate professionals | High |
| Remote positions | Target jobs that allow remote work | High |
| Use of collaboration tools | Slack, Google, GitHub for coordination | Medium |
| Spreadsheet tracking | Monitor job applications and progress | Medium |
What to Watch Next
Authorities are increasingly aware of this scheme. The FBI and DOJ have issued warnings, and Google has published research on the topic. Companies should be vigilant, especially when hiring remote IT staff. Verification of identities and backgrounds is crucial. A closer look at the same subject appears in AI Security Risks: Tech Giants Call for Cyber Defense. Anyone following the wider picture can start with UK One in One Out Asylum Scheme: Brutal Reality Exposed. The same theme surfaces in Victoria Work from Home Law Delayed: What It Means for Workers, which takes a different angle.
The leaked database provides valuable insight into the methods used by North Korea. It is a reminder that cyber threats are not always technical; they can also involve human infiltration. As the investigation continues, more details may emerge about the extent of this operation. Context on how this played out before sits in Trump Cuts Korea Drills Amid North Korea Battlefield Lessons. A companion piece, North Korea Fortifies Border With South Korea: DMZ Mine Threat, approaches the same subject from another angle.
FAQ
How does North Korea infiltrate IT workers into Western companies?
North Korea uses fake identities to apply for remote IT positions. Workers are organized into groups and use collaboration tools to coordinate their efforts. Once hired, they funnel salaries back to North Korea.
Why does North Korea use this scheme?
The primary goal is to generate revenue for North Korea's nuclear program. The workers also gain access to sensitive company data and systems, posing a security risk.
What can companies do to protect themselves?
Companies should implement thorough background checks, especially for remote hires. Verifying identities and monitoring for suspicious activity can help mitigate the risk.
Which countries are targeted?
Initially, the focus was on the United States, but as the US became more hostile, the actors shifted their attention to Europe. Companies in both regions should be alert.
Browse the Shop
Acacia frida deluxe solid wood bed frame |
Bedroom bench |
Bed chest drawers |
Lingerie dresser |
Frame base |
Mirror with jewelry storage |
30 Bathroom Vanity |
Memory foam queen mattress |
Mattresses for back pain |
Nightstand set of 2 |
Grand Goldman Shop |
Civil Lawyer
Deutschland Trikot WM 2026
