Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to generate fake resumes, alter profile photos, and assist in real-time responses during video interviews.

Date it happened

2021-01-01

Organisation involved

Yang Di, WaterPlum, Wagemole, Void Dokkaebi, UNC5267, Son Un Chol, Sok Kwang Hyok, Sim Hyon-Sop, Rim Un Chol, Ri Kyong Sik, Reconnaissance General Bureau, PurpleBravo, North Korean threat actors, Minh

Product, system or model

Zoom, WebSocket-based C2, Video interview platforms, Upwork, remote3, Remote admin tools, Raspberry Pi Zero, OtterCookie v4, OtterCookie v3, OtterCookie, Laptop farms, Job boards, InvisibleFerret, Git

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.