News

State-sponsored IT workers from the Democratic People’s Republic of Korea (DPRK) have escalated their infiltration methods by applying for remote positions using authentic-looking LinkedIn profiles stolen from real professionals. According to Security Alliance (SEAL), these deceptive accounts frequently display verified corporate email addresses and digital employment credentials to bypass hiring safeguards.

This operation represents an evolution of North Korea’s established “IT worker” strategy, where operatives assume fabricated identities to secure employment at foreign companies. Cybersecurity professionals track these activities under multiple designations including Jasper Sleet, PurpleDelta, and Wagemole. The dual objectives remain consistent: funding Pyongyang’s prohibited weapons programs through salary theft and conducting corporate espionage through unauthorized data access. In some instances, perpetrators escalate to ransomware demands after compromising networks.

Silent Push recently characterized this initiative as a “high-output funding mechanism” that provides attackers with privileged access to proprietary code repositories and corporate systems. Blockchain analytics firm Chainalysis revealed in an October 2025 publication how these operatives funnel cryptocurrency earnings through sophisticated laundering techniques: “They employ chain-hopping and token swapping via decentralized exchanges and bridge protocols to obscure financial trails between origin and destination wallets.”

Security professionals recommend proactive measures for professionals concerned about identity theft: clearly state official contact methods on social profiles and publicly flag potential impersonation attempts. SEAL emphasizes verification protocols: “Require applicants to demonstrate account ownership through direct LinkedIn connection requests during screening processes.”

The Norwegian Police Security Service confirmed multiple domestic enterprises fell victim to these schemes in 2025, with salaries funneled directly to North Korea’s nuclear program. “Organizations unknowingly hired DPRK operatives for remote technical roles,” stated PST’s official advisory.

Parallel Social Engineering Campaigns Emerge

Security researchers have identified complementary attacks under the Contagious Interview designation, where fake recruiters contact targets through LinkedIn with fraudulent job opportunities. Candidates receive skill assessments containing malicious code, as demonstrated in a Fireblocks recruitment impersonation campaign. Attackers instructed applicants to clone GitHub repositories and execute npm commands triggering malware installation.

Ori Hershko documented novel evasion techniques: “EtherHiding leverages blockchain smart contracts to host resilient command-and-control infrastructure.” Recent variants employ weaponized Microsoft VS Code task files that deploy cryptocurrency-stealing payloads like BeaverTail and InvisibleFerret through disguised web fonts.

Malware Frameworks Expand Attack Capabilities

A separate campaign analyzed by Panther Labs utilizes malicious npm packages (including env-workflow-test and vg-dev-env) to distribute the Koalemos remote access trojan. This modular JavaScript framework establishes beaconing connections, performs system reconnaissance, and executes twelve distinct commands for file operations and code execution.

“After DNS-based activation checks, the loader deploys the RAT as a detached process,” explained researcher Alessandra Rizzo. “Koalemos conducts comprehensive fingerprinting before establishing encrypted C2 channels for full remote control.”

DPRK Cyber Units Reorganize for Specialized Missions

CrowdStrike reports the Lazarus subgroup Labyrinth Chollima has fractured into three specialized divisions:

• Core Labyrinth Chollima: Focused on cyberespionage using tools like FudModule rootkit
• Golden Chollima: Conducts cryptocurrency thefts in developed economies (tracked as AppleJeus/Citrine Sleet)
• Pressure Chollima: Executes high-value digital asset heists (alias Jade Sleet/TraderTraitor)

DTEX analysis confirms shared infrastructure and techniques across these units despite operational specialization. All factions continue employing HR-themed lures, compromised software supply chains, and malicious Python/Node.js packages to maintain persistent access.

This strategic reorganization demonstrates North Korea’s commitment to refining its cyber capabilities for both financial extraction and intelligence collection objectives.