Uncovering a Vast North Korean Employment Scheme

A chance encounter with a mysterious job applicant leads to a shocking discovery

The story of Jo, a diligent and professional job seeker, has shed light on a massive North Korean employment scheme with significant national security implications. Jo, as he came to be known to the cybersecurity experts watching his every move, was a hard worker who rose early and worked late into the night, often six days a week. He juggled three jobs and constantly applied to more, sometimes as many as 50 a day, in an effort to make ends meet. His inbox was full of job matches and interview confirmations, but one of those interviews would lead a team of cybersecurity investigators to the inner workings of a vast North Korean employment scheme.

The Investigation Begins

On a Tuesday in June, Jo participated in a call for a hard-to-fill artificial intelligence role with Nisos, a corporate security and investigations company headquartered in Virginia. During the call, Jo appeared on screen wearing an orange T-shirt in a beige room, claiming to be in Palm Beach Gardens, Florida. However, when asked about a recent hurricane, Jo's response raised suspicions, and he hastily logged off when asked to share his screen. It was later discovered that there had been no hurricane in Palm Beach Gardens, and Nisos had already begun to suspect that Jo wasn't exactly who he said he was.

A Deeper Look into the Scheme

Nisos' executives believed they had stumbled upon one of the North Korean workers who had been engaging in a wide-ranging effort to place remote workers at U.S. companies. The goal of this scheme was to funnel money back to North Korea's coffers and, in some cases, steal sensitive information. To gain more information, Nisos decided to "hire" Jo, ship him a laptop, and monitor his activities. This bold move provided an unprecedented look into the human dynamics and inner workings of a suspected operative taking part in a sprawling international employment scheme.

Uncovering the Network

Over a roughly three-month investigation, Nisos uncovered an apparent network of at least 20 North Korean operatives, including Jo, who had collectively applied to at least 160,000 roles. The workers in the network, which some evidence showed were based in China, were employed by five U.S.-based companies and allegedly helped by an American citizen operating out of two nondescript suburban homes in Florida. Monitoring the team's communications nearly 24/7 through its laptop, Nisos gained insights into what its analysts say was likely a Democratic People's Republic of Korea (DPRK) IT team, including how it functioned and how its members communicated with each other. The investigation revealed that the workers were likely based in China and used only each other as references in their job applications. According to Jared Hudson, Nisos' chief technology officer, "If you can think of a best-case scenario for an analyst that follows these things, this is a dream come true, because you never get this kind of access to what we assume is happening. Now we could actually see it happening in real time." The discovery has significant implications, as the scheme is estimated to include hundreds of American companies, thousands of people, and hundreds of millions of dollars per year. The U.S. government has declared the issue a "code red," and the FBI has announced that the schemes are becoming "increasingly malicious." As the investigation continues, it remains to be seen how far-reaching the consequences of this scheme will be.

Top Stories

Recent Articles

More Articles