cyber.hendryadrian.com
Security Report · recordedfuture.com

Report Details North Korean IT Workers’ Fraudulent Hiring Operations

· Original article ↗

Summary

Recorded Future reports that PurpleDelta, a North Korean IT worker network, used fabricated personas and AI tools to apply to more than 1,100 companies and gain employment at at least ten organizations, posing insider and data risks.

Key points

  • Insikt Group identified at least 22 fabricated personas linked to PurpleDelta clusters that applied to jobs at over 1,100 companies, with activity spanning at least eight job platforms.
  • The operators were highly likely to have secured employment at ten or more organizations, including companies in AI, fintech, IT services, media, and nonprofit sectors.
  • Tradecraft included AI-generated profile photos, custom ChatGPT assistants, real-time transcription, multiple browser profiles, identity documents, and detailed application tracking.
  • Operators recorded interviews, work sessions, and internal meetings, and used personal devices and bank accounts while employed.
  • Facilitators maintained company-issued hardware, while operators coordinated through Telegram and Slack and recruited people to lend identities, accounts, or labor.
  • Recorded Future warns of potential insider, intelligence-collection, and supply-chain risks, though it says it cannot rule out data or source-code exfiltration rather than confirming it.
  • The report recommends checking hiring and employment indicators, strengthening identity verification, reviewing access privileges, and monitoring company devices and remote-access software.

Article Details

Publisher
Recorded Future (Insikt Group)
Report Period
Late 2024 to early 2025; the report also describes tracking since 2025.
Scope
PurpleDelta fraudulent employment operations, including persona management, hiring activity, employment, and facilitation.
Key Statistics
  • One cluster applied to jobs at over 1,100 companies.
  • At least 22 fabricated personas were identified across multiple clusters.
  • Operators applied to as many as 60 or more jobs per day across at least 8 job platforms.
  • Operators were highly likely to have been employed at ten or more organizations.
  • Of the companies applied to, approximately 41% were in IT and software services, 26% in staffing and consulting, and 10% in healthcare and biotechnology.
Recommendations
  • Track PurpleDelta email addresses, personas, and IP addresses to identify fraudulent applicants and support network blocking and alerting.
  • Use identity verification during hiring, onboarding, and employment, including live video checks against government-issued identification.
  • Ship company devices only to verified addresses associated with the named individual, and geolocate laptops to check their locations against employee login locations.
  • Apply least-privilege access controls, limit access to proprietary information, and use network segmentation.
  • Review access privileges, software installation history, and communications for individuals matching the report's indicators.

Indicators of compromise

TypeIndicatorContext
DOMAINminicursor[.]comDomain for a purported employer tied to recruitment postings seeking representatives to create freelancer accounts for the operation.
DOMAINtrustidcard[.]comIdentity-document generation service used by PurpleDelta operators to establish fabricated personas.
IPV4104[.]129[.]55[.]3IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]1[.]79IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]102[.]119IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]103[.]238IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]111[.]106IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]112[.]86IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]115[.]202IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]115[.]254IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]120[.]177IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]120[.]203IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]121[.]146IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]134[.]123IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]137[.]28IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]14[.]73IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]145[.]255IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]145[.]7IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]147[.]147IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]160[.]220IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]164[.]246IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]17[.]141IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]173[.]139IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]177[.]189IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]19[.]244IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]199[.]214IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]20[.]50IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]207[.]214IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]221[.]132IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]224[.]179IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]224[.]93IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]226[.]188IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]229[.]199IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]229[.]208IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]243[.]171IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]245[.]40IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]251[.]19IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]254[.]82IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]34[.]67IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]44[.]236IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]45[.]193IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]46[.]118IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]47[.]239IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]51[.]76IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]52[.]123IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]56[.]226IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]7[.]202IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]72[.]75IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4104[.]253[.]90[.]150IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4155[.]94[.]198[.]2IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4167[.]88[.]61[.]117IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4167[.]88[.]61[.]250IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4189[.]1[.]170[.]50IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4192[.]161[.]60[.]140IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4204[.]188[.]232[.]195IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV4218[.]24[.]120[.]118IP address listed in Appendix A as an indicator associated with PurpleDelta activity.
IPV423[.]106[.]169[.]120IP address listed in Appendix A as an indicator associated with PurpleDelta activity.

Threat Actors

Famous ChollimaA threat actor designation from another vendor that the report says overlaps with PurpleDelta.Jasper SleetA threat actor designation from another vendor that the report says overlaps with PurpleDelta.PurpleBravoA related cluster of activity described as deploying malware through fraudulent recruitment campaigns targeting software developers, primarily in cryptocurrency.PurpleDeltaRecorded Future's designation for the cluster of activity associated with North Korean IT workers.UNC5267A threat actor designation from another vendor that the report says overlaps with PurpleDelta.

Products

ChatGPTacross multiple clusters, some of which were supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service, and were highly likelyGoogle Chromepositions per day across multiple job platforms, used multi-account management browsers and separate Google Chrome profiles to manage distinct personas simultaneously, and maintained detailed tracking spreadsheets toGoogle TranslateOnce employed, operators recorded internal meetings at victim organizations and used Google Translate to draft pre-written excuses to justify using personal devices and bank accounts for work.SlackEvidence from recorded sessions also indicates that PurpleDelta operators coordinated via Telegram and Slack, and at least two individuals were identified as facilitators who maintained company-issued hardware for theTelegramEvidence from recorded sessions also indicates that PurpleDelta operators coordinated via Telegram and Slack, and at least two individuals were identified as facilitators who maintained company-issued hardware for theUpworkoperator maintains multiple fabricated identities across platforms, including GitHub, LinkedIn, Medium, Upwork, and a range of smaller freelancing sites, with personas deliberately constructed to project credibility

Tools

AnyDeskVideo evidence indicates that PurpleDelta operators use identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, and coordinate via Telegram and Slack, with support from facilitators whoAstrill VPNIn addition to purchasing infrastructure, the PurpleDelta operators were consistently observed using Astrill VPN, a previously observed tactic that has also been well documented in open sources.Caption.EdPurpleDelta uses iTop Screen Recorder to record video during calls, as well as Krisp and Caption.Ed to record and transcribe voice.Google Chrome Remote DesktopTo access the devices being maintained by facilitators, PurpleDelta uses a variety of remote desktop tools, including AnyDesk, Google Chrome Remote Desktop, Jump Desktop, and RealVNC.iTop Screen RecorderPurpleDelta uses iTop Screen Recorder to record video during calls, as well as Krisp and Caption.Ed to record and transcribe voice.Jump DesktopTo access the devices being maintained by facilitators, PurpleDelta uses a variety of remote desktop tools, including AnyDesk, Google Chrome Remote Desktop, Jump Desktop, and RealVNC.KrispPurpleDelta uses iTop Screen Recorder to record video during calls, as well as Krisp and Caption.Ed to record and transcribe voice.MEmuPurpleDelta operators use eSIM Plus, Blacktel, and Google Voice, as well as the Android emulation software MEmu; for infrastructure, they use Hostinger, Namecheap, GoDaddy, IPRoyal, and Proxy-Seller.NetProviderIn at least one instance, a network monitoring application called NetProvider was observed alerting the operator to unusually high traffic during a live interview session, suggesting that operators may monitor their ownRealVNCTo access the devices being maintained by facilitators, PurpleDelta uses a variety of remote desktop tools, including AnyDesk, Google Chrome Remote Desktop, Jump Desktop, and RealVNC.WaveboxPersonas are broken out into separate Google Chrome profiles and Google Calendars, and in one instance, Insikt Group observed the operators experimenting with Wavebox, a multi-account browser tool for account management.

Countries

ChinaInsikt Group has identified several clusters of activity linked to PurpleDelta, Recorded Future's designation for North Korean IT workers, comprising multiple operators likely based in China.North Korea

Industries

AImaintained at least 22 fabricated personas across multiple clusters, some of which were supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from anCryptocurrencymalware through fraudulent recruitment campaigns targeting software developers primarily in the cryptocurrency space, indicating the broader potential for intelligence collection, downstream compromise, andfinancialthat submitted applications to over 1,100 companies across the software, staffing, healthcare, and financial sectors, with operators submitting as many as 60 or more applications per day across at least 8 jobfintechInsikt Group observed evidence that PurpleDelta operators were employed by at least ten organizations in the AI, fintech, IT services, media, and non-profit industries.healthcare and biotechnologyBetween late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors.IT servicesInsikt Group observed evidence that PurpleDelta operators were employed by at least ten organizations in the AI, fintech, IT services, media, and non-profit industries.MediaMany of the operators have a nexus in Shenyang, China, as indicated by their professional profiles, social media presence, and artifacts observed on their systems.Non-profitInsikt Group observed evidence that PurpleDelta operators were employed by at least ten organizations in the AI, fintech, IT services, media, and non-profit industries.software and technologyBetween late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors.staffing and consultingBetween late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors.

Related Articles