North Korea Infiltrates Remote US Jobs to Fund Weapons

North Korean IT workers were strategically deployed to China and Russia, posing as freelance IT professionals working remotely for U.S. companies. The IT workers used proxies to mask their actual location by rerouting their internet traffic through servers in the U.S. To further obscure their location and activities, some North Korean IT workers paid Americans to utilize their home Wi-Fi networks. Some went to the extent of compensating U.S. individuals to attend interviews on their behalf and engage in video conferencing with employers. In one specific case, an American agreed to participate in this scheme, accepting financial compensation from a North Korean worker to purchase multiple laptops and leave them connected to their home Wi-Fi network. This allowed the North Korean worker to access these computers remotely, effectively masking their location. In exchange for this service, the American received a monthly payment of one hundred dollars per laptop. They also received payments from the freelance work into their personal American banking accounts, which were later transferred to the North Korean worker. To maintain credibility and legitimacy, North Korean IT workers created “portfolio websites.” These websites featured profiles of freelance IT professionals with fictitious portfolios of previous IT work. Communication among these operatives was held through platforms such as Slack, which is commonly used by remote IT professionals. Within these communication servers, there were discussions of false identities used to open accounts on payment and freelance platforms. Additionally, the IT workers used pseudo-email and adopted personas on social media platforms to veil their identities and intentions.