DPRK Remote Work Tactics: Leveraging Code-Sharing Platforms

DPRK IT workers have leveraged popular code-sharing platforms such as GitHub, CodeSandbox, and Medium to cultivate convincing developer portfolios and land remote positions under fabricated identities, with investigators identifying roughly 50 active GitHub accounts and 12 resumes found, while seven additional profiles have since been deactivated.

These operatives use deepfake profile photos, forged resumes hosted on Vercel and freelance portals, and adopted nationalities—predominantly U.S.—to bypass employer vetting, according to GBHackers on Security. The network is orchestrated by Department 53, funneling $250 million–$600 million annually into North Korea’s weapons programmes. Major incidents include Operation Dream Job (Aug 2020), the KnowBe4 Hiring (Jul 2024), the Chapman Laptop Farm (2019–2023), and the Bybit Heist (Feb 2025).

Russia’s complicity in recruiting DPRK tech labour under student visas underscores a widening geopolitical threat, with recent operations by Kimsuky using Russian infrastructure and email addresses highlighted as part of a coordinated Russia-DPRK cyber nexus. As remote hiring processes evolve, organisations should strengthen identity verification, deploy AI-driven image analysis, and cross-reference behavioural patterns across platforms to stem illicit funding fuelling North Korea’s programmes.