GoKawiilFraudulent North Korean IT workers are getting better at infiltrating organizations, but a number of indicators can help organizations stay ahead.
A new blog post from Huntress detailed a number of investigations the security firm conducted throughout 2026. Specifically, Huntress assisted several organizations this year in validating "suspicions that they've hired North Korean nationals posing as legitimate workers."
In recent years, operatives from the Democratic People's Republic of Korea (DPRK) have infamously posed as IT workers — generally through fake or stolen identities — to get hired at companies. Once hired, these employees send their wages back to the North Korean regime, and possibly plant malware or steal data depending on the government's needs. Blog post authors Jai Minton and James Maclachlan wrote that these agents "have significantly improved and increased their activity over the past few years."
Related:Ransomware Negotiator Pleads Guilty to BlackCat Scheme
Moreover, these workers are skillful at their jobs and would otherwise fit into an enterprise IT environment.
The trend is alarming on multiple levels, as it involves an insider threat orchestrated by a well-resourced foreign government. And because these remote workers are hired like any other employee, they're not conducting traditional data breaches or compromising accounts. Between this and the employees' use of VPNs and proxy services to mask location, it can be challenging to detect this kind of fraud.
Huntress divided its blog across three sets of investigations: one in February involving the healthcare sector and two in August involving organizations in the financial services sector.
Three Investigations into DPRK IT Worker Fraud
In February, an Australian firm in the healthcare industry contacted Huntress under suspicions that three employees were North Korean workers impersonating Chinese individuals. The suspicion arose from the employees' use of certain infrastructure, such as Astrill VPN, which has been tied to DPRK worker fraud in the past.
The security firm analyzed relevant logs, authentication efforts, and activity over the previous six months and discovered that the employees were also utilizing IPRoyal Proxy, an otherwise legitimate commercial proxy service provider, and the bulletproof hosting service WorkTitans B.V., "that appears to have been raided by the Fiscal Information and Investigation Service of the Netherlands (FIOD)."
... continue reading