Deepfakes and Deception: North Korean IT Workers Infiltrating Companies to Fund Regime

A new Threat Intel report by Rakesh Krishnan details North Korean IT workers infiltrating the global remote job market through fake identities, deepfakes and compromised platforms to fund the regime’s weapons programmes. Investigators found around 50 active GitHub accounts linked to suspected DPRK workers, with repositories spanning web apps, Android, ReactJS, NodeJS, Docker and blockchain tools, and some accounts were later deactivated while others remain active.

The workers also target other platforms such as CodeSandbox, Freelancer, RemoteHub, CrowdWorks JP and Medium, with interests spanning Matlab, WebRTC, Google Firebase, AWS, Digital Ocean, Jekyll, Docker, React JS, Node JS and Android apps. Fabricated resumes hosted on sites like LaborX, FlowCV or custom Vercel sites feature titles such as Senior Laravel Developer (US) and AI Architect (US), with some including AI‑generated deepfake portraits.

The report links these IT workers to incidents including Operation Dream Job (2020), KnowBe4 Hiring Scandal (2024), Christina Chapman Laptop Farm (2019–2023) and Bybit Heist (2025, Lazarus), and notes secret IT workers generate $250m-$600m annually for North Korea, according to a UN Security Council report published in March 2024.

It also highlights a Russia–North Korea nexus, with DPRK labour absorbed amid Ukraine-related shortages, and warns that DPRK groups like Kimsuky have used Russian infrastructure for credential theft and crypto‑exchange attacks.