North Korean IT Workers Use VPNs and Laptop Farms to Evade Identity Verification

In a sprawling network of covert remote labour, more than 10,000 North Korean IT professionals have infiltrated global technology and freelance marketplaces by exploiting VPNs, VPS and laptop farms to conceal their origins, with state-backed cyber units using them to fund sanctioned weapons programmes and gather intelligence across fintech to critical infrastructure design.

Since at least 2018, Pyongyang has orchestrated a vast operation deploying skilled developers abroad under fabricated identities, with workers posing as freelancers or full-time staff in China, Russia, Southeast Asia, and even within North Korea itself via tightly controlled gateways.

By routing connections through multiple VPS providers and VPN services, these operatives evade geolocation checks on platforms such as Upwork, LinkedIn and GitHub, and some operators maintain laptop farms to spin up new personas when one identity is blocked.

Security researchers tracking groups like Jasper Sleet and Moonstone Sleet estimate over 10,000 DPRK operatives are embedded in global enterprises, according to KELA, with IoCs including VPN binaries, VPS provider IP ranges from Hong Kong and Russia, and specific infostealer file hashes. According to Microsoft’s threat intelligence team, these operators often rely more on social engineering and AI-generated headshots than zero-day exploits to secure roles within target organisations.