tl;dr
Blockchain investigator ZachXBT uncovered a North Korean operation infiltrating Western tech companies through fake identities in remote developer roles. A device from one of five DPRK workers revealed use of forged social security numbers, fake accounts on Upwork and LinkedIn, rented computers, and...
Blockchain investigator ZachXBT uncovered a sophisticated operation run by North Korean IT workers infiltrating Western tech companies through remote development roles. An unnamed source provided access to a device from one of five DPRK workers, revealing their extensive use of fake social security numbers, Upwork and LinkedIn accounts, phone numbers, and rented computers to secure developer jobs.
The team coordinated their work using Google products, organizing schedules, tasks, and budgets while primarily communicating in English. Weekly reports from 2025 showed struggles with job requirements, highlighting challenges despite persistent efforts.
The DPRK workers employed a consistent operational method: purchasing fake accounts, renting devices, and using AnyDesk for remote access. Their expenses included AI subscriptions, VPNs, and proxies to maintain fake identities. Detailed personas and work histories were created for each fake identity, with payment channels linked through a specific wallet address tied to multiple fraudulent activities.
One major incident linked to the group was the $680,000 Favrr exploit in June 2025, where the company’s CTO and other developers were revealed as DPRK workers using fraudulent credentials. The CTO, known as “Alex Hong,” exhibited suspicious traits such as deleted LinkedIn profiles and unverifiable history.
Despite sophisticated fronts, compromised devices showed frequent use of Google Translate with Korean translations and operation via Russian IP addresses, confirming North Korean origins. ZachXBT pointed out difficulties in addressing this issue due to poor collaboration between service providers and private companies, alongside defensive hiring teams reluctant to accept infiltration warnings.
The workers convert earnings into cryptocurrency via Payoneer, operating with persistence rather than sophistication, flooding the global job market for remote development roles. This exposure highlights the extensive scale of North Korean infiltration within Western technology firms, with this team being only one of potentially hundreds executing similar schemes across remote platforms.