DPRK-Linked Job Fraud Expands Beyond IT Into Healthcare, Sales and Finance
Summary
Investigations say DPRK-linked job-fraud operators are targeting roles beyond IT, using synthetic identities, forged documents, VPNs and AI. Cases span healthcare, finance, sales and marketing; one PurpleDelta cluster applied to jobs at more than 1,100 companies.
Key points
- The scheme uses deceptive hiring of remote workers—not a conventional malware intrusion chain—to earn income linked to North Korea’s weapons programs.
- Huntress reported that three employees at an Australian healthcare company were flagged in February 2026 as North Korean workers impersonating Chinese individuals; indicators included VPN and proxy use, fraudulent identity documents and onboarding anomalies.
- At an unnamed financial services firm, investigators found PiKVM on a device and a Guermok USB capture card attached days later; the sequence raised concerns about remote access and webcam use.
- Recorded Future said a PurpleDelta-linked cluster applied to jobs at more than 1,100 companies between late 2024 and early 2025, using 22 fabricated personas and applying for at least 60 positions per day across 10 platforms.
- Reported tactics include AI-assisted interview responses, synthetic identities, forged documents, VPNs and proxies, as well as laptop farms and facilitators managing company-issued hardware.
- Organizations are advised to strengthen identity verification and conduct rigorous background checks; unknowingly hiring or paying DPRK workers can also create sanctions and compliance risks.
Article Details
- Event Type
- DPRK-linked employment fraud scheme expanding beyond IT into sales, marketing, healthcare, and finance.
- Impact
- Fraudulent hires can provide remote access to victim organizations and expose them to payroll and compliance risks, including potential sanctions violations. The scheme generates income for North Korea's weapons programs. The article reports job applications and hiring cases, but does not confirm data theft in the described incidents.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | trustidcard[.]com | Domain for TrustID Card, identified as an illicit ID-generation service from which PurpleDelta operators sourced identity documents. |
People
Alexander Paul TravisThe article reports that he was sentenced in February or March in connection with a laptop-farm scheme.Audricus PhagnasayThe article reports that he was sentenced in February or March in connection with a laptop-farm scheme.Erick Ntekereze PrinceSentenced to 18 months in prison for running a laptop farm for North Korean remote IT workers.Jason SalazarThe article reports that he was sentenced in February or March in connection with a laptop-farm scheme.Kejia WangSentenced to 108 months in prison for operating a laptop farm that helped IT workers obtain remote jobs.Matthew Isaac KnootSentenced to 18 months in prison for running a laptop farm for North Korean remote IT workers.Oleksandr DidenkoThe article reports that he was sentenced in February or March in connection with a laptop-farm scheme.Zhenxing WangSentenced to 92 months in prison for operating a laptop farm that helped IT workers obtain remote jobs.
Threat Actors
Jasper SleetOne of the names under which the article says the DPRK-linked IT worker scheme is tracked; Microsoft reported Jasper Sleet activity involving Workday Recruiting endpoints.Nickel TapestryOne of the names under which the article says the DPRK-linked IT worker scheme is tracked.PurpleDeltaA name under which the article says the DPRK-linked scheme is tracked; Recorded Future linked a cluster to more than 1,100 company job applications.UNC5267One of the names under which the article says the DPRK-linked IT worker scheme is tracked.Void DokkaebiOne of the names under which the article says the DPRK-linked IT worker scheme is tracked.WagemoleOne of the names under which the article says the DPRK-linked IT worker scheme is tracked.
Vendors
Products
AnyDeskPurpleDelta operators have been found to rely on identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, as well as coordinate via Telegram and Slack to complete work, andAstrill VPNHuntress found cases involving Astrill VPN, IPRoyal Proxy, PiKVM, SendGB, and Guermok.ChatGPT“During job interviews, they used screen recording software alongside AI transcription and chatbot tools to generate real-time answers, often repeating ChatGPT responses verbatim,” Recorded Future added.Guermok#PurpleDeltaIPRoyal ProxyHuntress found cases involving Astrill VPN, IPRoyal Proxy, PiKVM, SendGB, and Guermok.PiKVMInvestigations also show use of laptop farms, PiKVM, and related infrastructure to maintain access, helping fund North Korea’s weapons programs and exposing victim companies to sanctions and compliance risks.TinyPilotThe use of KVM switches like PiKVM or TinyPilot has been previously attributed to the North Korean IT worker scheme, allowing the remote threat actors to connect to devices hosted on laptop farms.TrustID Cardintelligence (AI) and using identity documents sourced from an illicit ID-generation service called TrustID Card (“trustidcard[.]com”).Workday Recruiting Web ServiceIn April, Microsoft disclosed it observed Jasper Sleet actors accessing Workday Recruiting Web Service endpoints that are exposed through external career sites likely to obtain details about open roles and recruitment
Countries
Australiainformation entries, etc.),” cybersecurity and intelligence agencies from the U.S., Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand, and the U.K.ChinaThe threat actors, comprising multiple operators likely based in China, are suspected to have maintained 22 fabricated personas, some synthetically generated using artificial intelligence (AI) and using identityNorth KoreaInvestigations also show use of laptop farms, PiKVM, and related infrastructure to maintain access, helping fund North Korea’s weapons programs and exposing victim companies to sanctions and compliance risks.
Industries
Biotechnologyover 1,100 companies, mostly in software and technology, staffing and consulting, and healthcare and biotechnology sectors, between late 2024 and early 2025.CryptocurrencyA series of reports from Nisos have revealed how DPRK operatives are using employment fraud to target cryptocurrency firms with an aim to conduct asset theft.financeDPRK-linked threat actors are expanding their “IT worker” scheme into sales, marketing, healthcare, and finance by using synthetic identities, forged documents, VPNs, proxy services, and AI tools to secure remote jobsHealthcareDPRK-linked threat actors are expanding their “IT worker” scheme into sales, marketing, healthcare, and finance by using synthetic identities, forged documents, VPNs, proxy services, and AI tools to secure remote jobsInformation Technologyof Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales andSales and marketingtechnology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession.software and technologyit observed one cluster linked to PurpleDelta applied to jobs at over 1,100 companies, mostly in software and technology, staffing and consulting, and healthcare and biotechnology sectors, between late 2024 and earlystaffing and consultingto PurpleDelta applied to jobs at over 1,100 companies, mostly in software and technology, staffing and consulting, and healthcare and biotechnology sectors, between late 2024 and early 2025.