Fraud Management & Cybercrime
,
Governance & Risk Management
,
Remote Workforce
Prompt Candidates to Wave, Check IP Addresses and Ask About Their Supposed Location
They’re young, tech-savvy and often the most productive remote worker on the team. They’re a major security risk numbering in the thousands that a multitude of Fortune 500 companies have unwittingly ushered into their network. They collectively earn up to half a billion annually in wages that sustain a despotic and criminal regime.
See Also: Attack Surface Management for Dummies®
They are North Korean IT workers – freelancers and salaried workers using stolen identities, false resumes and deepfakes to fool otherwise sophisticated corporations into illegally giving them a job.
They are every hiring manager’s worst nightmare.
There are “3,000 hands on keyboards” and easily “30,000 different email addresses” active at any given time used by North Koreans to fraudulently obtain work at Western companies, each email linked to multiple worker personas, said Michael “Barni” Barnhart.
“Worker scheme recruitment starts as early as age seven – when a high aptitude for science, math and problem solving develops. North Korea grooms children at a very early age, so that by the time they’re 18, they’re not on the job saying, ‘what do I do?’ They’re highly skilled IT workers,” said Barnhart, who closely tracks the phenomenon as a nation-state threat investigator at data loss prevention firm DTEX.
They’re also very good at pretending to be someone else. A suburban Arizona house raided by U.S. federal agents in 2023 hosted laptops used by remote North Korean workers to do IT work at more than 300 companies. KnowBe4 in 2024 copped to hiring a software engineer who was really a North Korean worker who used his access to load malware. SentinelOne in April 2025 said it tracked 360 fake North Korean personas applying for jobs at the firm.
But employers don’t need to break the bank to root out fake workers. Cost-effective detection starts with knowing your environment, your workforce and your weak points.
Location, Location, Location
Most North Korean remote IT workers don’t work from Pyongyang. The United Nations estimated last October that at least half are located in neighboring China, with smatterings situated in Russia, Africa and Southeast Asia.
By necessity, workers must pretend to be somewhere else, often in many different places at once. “One IT worker can run up to eight different personas – all in different locations. One may be an admin persona working on infrastructure or on a job platform. Another on Guru, but they all compartmentalize realism in a few different ways,” Barnhart said.
Scam remote workers rely on VPNs, proxy or compromised servers, paid cloud infrastructures and shared IP addresses to mask their true location.
“I recommend employers contact their network security vendors about how deep pack inspection and other tools can be used to detect inbound VPN and proxy connections,” said Brett Winterford, head of threat intelligence at Okta.
Deep packet inspection tools scan network metadata to identify anomalous, external VPN or proxy connections. If malicious activity is flagged, employers can compare a worker’s claimed location against exit node activity. Proxy detection follows a similar playbook.
“The easiest way is checking the IP address online to see if it’s showing the traditional signatures of being an open proxy. For things like residential proxies – that are a little bit harder to discover – there are services out there that sell data on which IP’s belong to which services,” said Nick Roy, threat researcher and founder of nkinternet.com, an open-source intelligence site tracking North Korea’s technology and cyber capabilities.
According to Roy, it comes down to how much effort a threat actor puts into their proxy. If not “secured properly,” detection, verification and threat reporting is made easier for employers.
But DPI tools are neither a defense nor a permanent fix against highly sophisticated actors capable of mimicking normal traffic or piggybacking off residential IP addresses to evade detection. Threat actors take advantage of multiple online services that claim to provide “untraceable or SIM free SMS reception” as well as VoIP numbers that allow identities to operate in a cyber grey area, Winterford said.
“These services vary wildly in robustness and timeliness of message reception. Criminal use of unlinked SMS services and VoIP numbers is a constant problem for employers,” but aren’t always a sign of malicious intent.
Tracing a VoIP number back to its owner involves a trusted reverse phone lookup service, using network packet analyzers to determine an internet protocol address – a feature included in certain DPI offerings – or directly contacting the cellular provider for call data.
“It more comes down to unfortunately needing to take a more risk-based approach when hiring,” Roy said.
Each service – VPNs, proxy connections and VoIP numbers – “on their own” isn’t necessarily a bad sign but “if you see someone apply for a job from a VPN provider like Astrill,” chances are that’s a North Korean threat actor. Microsoft identified Astrill as a North Korean favored tool in an alert published last June.
Root Out Identity Inconsistencies
Fabricated or stolen identities run rampant on platforms LinkedIn and GitHub.
Their resumes are padded with false company affiliations, relevant skillsets, untraceable references and fraudulent project histories. They have little or no visible account activity such as posts, comments or likes, sparse connections and often AI-generated profile images, which can be verified through reverse image searches.
Fake worker accounts seem to favor certain words in their profiles such as “dev, star, top or sun,” Roy said. Same goes for accounts with “a lot of projects, but not a lot of activity.” In Roy’s experience, these are dead giveaways of a cloned or stolen profile.
According to Brian Jack, CISO at KnowBe4, there’s often no separating out fabricated profiles from stolen ones since they almost always present as “thin or hollow.”
The other half of detection success for employers comes down to experience and exposure. “The more candidates you interview, the easier you’re able to separate AI-based responses and profiles from stolen ones and beyond,” Jack said.
The easiest way to confirm identity and vet candidates is “to just send a message to the person over LinkedIn and confirm certain details to determine if a threat is real or not,” Roy said.
Deepfake Deception
A motivated candidate with nothing to hide should never be too busy to meet face-to-face or on camera, making an unwillingness or clear apprehension to appear on live video another red flag.
North Korean actors have used excuses such as a malfunctioning camera to avoid being seen, but increasingly they use real-time deepfakes to mask their true appearance. “AI dramatically improve the economics,” said Siwei Lyu, director of the Institute of AI and data science at the University of Buffalo.
“One operator can now convincingly impersonate many identities, pass interviews and maintain remote presence at scale. This reduces cost, increases success rates, but it also makes attribution harder, turning an already risky hiring environment into a high-level, asymmetric threat for companies,” he said.
According to Lyu, telltale “visual artifacts” present in earlier deepfake tech aren’t as obvious anymore. But “behavioral inconsistencies” such as delayed or overly smooth reactions, limited spontaneous motion, constrained gaze or head dynamics as well as inorganic speech patterns are reliable indicators of a deepfake.
“Current models are strong at appearance and voice but still weak at long-horizon, interactive behavior,” Lyu said.
During an interview, employers can start with a simple test by asking candidates to wave “hello.” Rapid, natural movements could prompt a video glitch. Asking an interview to move the camera closer can also disrupt the illusion.
‘How Fat Is Kim Jong Un?’
North Korean workers may claim to be natives of Eastern Europe or Southeast Asia, but rarely know much about their purported homelands. They also bring baggage from a cloistered North Korean upbringing.
Interviewers can ask about local or cultural information threat actors would be unaccustomed to or, in more severe cases, pose politically sensitive questions to trip them up in real time.
“My favorite interview question, because we’ve interviewed quite a few of these folks, is something to the effect of ‘How fat is Kim Jong Un?’ They terminate the call instantly, because it’s not worth it to say something negative about that,” said Adam Meyers, a CrowdStrike senior vice president, during an April 2025 conference, reported The Register.
But, “if you feel the need to ask that question, then you likely already made up your mind about the candidate being a fraud,” Jack said.
This tactic “won’t work on certain subcontractors because that individual can say whatever he wants without loyalties or fear of government oppression waiting for him,” Barnhart said.