Kibu Report Examines North Korean Fake-Worker Schemes Targeting Remote IT Jobs
Summary
Kibu’s Q1 2026 report examines alleged North Korean IT-worker schemes using fabricated identities to gain remote jobs, access company systems, and divert earnings. It highlights hiring identity verification as a defense and promotes Kibu’s own product.
Key points
- The report describes a scheme it calls “Jasper Sleet,” in which DPRK-linked operatives allegedly use fabricated identities, credentials, and AI-generated faces or voices to obtain remote IT jobs.
- After hiring, operatives may receive valid company access, expand their responsibilities, steal data, or seek ransom; the report says wages are funneled to North Korea.
- The report says some operatives used U.S. collaborators to set up company-issued laptops with remote-access software, making their employment appear more convincing and circumventing some network detection.
- A U.S. Department of Justice indictment cited in the report said 14 North Korean nationals generated more than $88 million over six years through an IT-worker scheme.
- The report cites estimates that North Korean cybercrime has generated more than $2 billion for the regime and may fund about 40% of its WMD program.
- It argues that hiring-stage identity verification is important, while noting that AI detection tools can miss synthetic profiles and incorrectly flag legitimate applicants; it also promotes Kibu’s verification product.
Article Details
- Publisher
- Kibu
- Report Period
- Q1 2026
- Scope
- North Korean fake-employee operations, identity-based social engineering, and hiring verification
- Key Statistics
- A December 2024 U.S. Department of Justice indictment said 14 North Korean nationals generated over $88 million over six years.
- Some estimates cited by the report put North Korean cybercrime proceeds at over $2 billion.
- The report estimates illegal cyberattacks provide 40% of North Korea's WMD funding.
- SentinelOne received over 1,000 job applications linked to DPRK operatives.
- Recommendations
- Strengthen identity verification before hiring, particularly for remote IT roles.
- Use trusted human networks and peer validation alongside technical detection; do not rely solely on automated tools or HR gatekeepers.
MITRE ATT&CK
Malware
Vendors
Products
Countries
AustraliaUK, Australia, and Japan, often in sectors including AI, web development, and even positions with government agencies orChinaFabricate identities – IT workers in North Korea and China create false personas complete withGermanyWhile the majority of these operatives work from China, they've been identified in the United States, Germany, Portugal, theJapanUK, Australia, and Japan, often in sectors including AI, web development, and even positions with government agencies orNorth KoreaNORTH KOREA'S WMD PROGRAM?PortugalWhile the majority of these operatives work from China, they've been identified in the United States, Germany, Portugal, theRussiaThese nationals worked for DPRK-controlled companies in China and Russia, using borrowed, stolen, or fabricated identitiesUnited KingdomUK, Australia, and Japan, often in sectors including AI, web development, and even positions with government agencies orUnited StatesWhile the majority of these operatives work from China, they've been identified in the United States, Germany, Portugal, the