Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

Summary

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to generate fake resumes, alter profile photos, and assist in real-time responses during video interviews.

Developers

• OpenAI
• Large language model developers
• Deepfake technology developers

Deployers

• Yang Di
• WaterPlum
• Wagemole
• Void Dokkaebi
• UNC5267
• Son Un Chol
• Sok Kwang Hyok
• Sim Hyon-Sop
• Rim Un Chol
• Ri Kyong Sik
• Reconnaissance General Bureau
• PurpleBravo
• North Korean threat actors
• Minh Phuong Ngoc Vong
• Matthew Isaac Knoot
• Lazarus Group
• Ko Chung Sok
• Kim Ye Won
• Kim Sang Man
• Kim Ryu Song
• Kim Mu Rim
• Jong Song Hwa
• Jong Kyong Chol
• Jang Chol Myong
• Hyon Chol Song
• Gwisin Gang
• Government of North Korea
• Famous Chollima
• Department 53
• Contagious Interview
• Christina Chapman
• Choe Jong Yong
• Cho Chung Pom

Harmed parties

• Western companies
• Web3
• SSA
• Social Security Administration
• Recruitment teams
• Oleksandr Didenko
• National security and intelligence stakeholders
• macOS users
• Jiho Han
• IRS
• Interviewees
• Internal Revenue Service
• Human resources staff
• Hiring managers
• Haoran Xu
• Epistemic integrity
• Employers
• Developers
• Cryptocurrency platforms
• Companies in the United States
• Chunji Jin
• Blockchain projects
• Andrew M.
• Targets of fraudulent professional opportunities

Tags

• North Korea
• DPRK
• Fraud
• Remote worker fraud
• Identity theft
• Credential theft
• response
• Deepfake
• IT worker
• Wagemole
• espionage