A North Korean IT operative infiltrated a major New Zealand corporation as a fully remote engineer using a fraudulent identity. This incident highlights a growing global cyber campaign by North Korea, which systematically infiltrates companies worldwide to generate foreign revenue and steal sensitive data.

Inside the Infiltration: Scheme Overview and Deceptive Tactics

A North Korean IT operative was discovered working as a fully remote IT contractor for a major corporation in New Zealand using a stolen identity. According to the 2026 Cyber Threat Report released by New Zealand’s National Cyber Security Centre (NCSC), the targeted firm grew suspicious of the remote worker’s identity documentation and alerted the police and NCSC. Investigations revealed that the engineer was originally from North Korea and had leveraged sophisticated identity forgery techniques to conceal their true nationality and physical location. Furthermore, the operative used a domestic address in New Zealand and recruited a local accomplice to receive company-issued laptops, which were then remotely controlled. This setup aligns with the widespread “laptop farm” operational model seen globally—a systematic scheme designed to secure remote positions at foreign enterprises and funnel lucrative salaries back into North Korea’s military programs. U.S. authorities estimate that such North Korean remote worker schemes generated approximately \$800 million (around 140 billion yen) in illicit funds in 2024 alone.

Local Accomplices and Geolocation Spoofing via Laptop Farms

When North Korean IT operatives target overseas companies, third-country physical hubs known as “laptop farms” play a crucial role. Operatives exploit stolen personally identifiable information—such as U.S. Social Security Numbers (SSNs), driver’s licenses, and passports—to impersonate real individuals during the application process. Once hired, corporate laptops dispatched by the employer are delivered to residential addresses or mail forwarding services managed by local facilitators. As shown in the diagram below, the methods for concealing these operational hubs continue to diversify:

Local accomplices set up the laptops and configure commercial VPNs like Astrill VPN, alongside remote desktop software or hardware KVMs such as AnyDesk, RustDesk, and TinyPilot. This allows operatives located in North Korea, China, Russia, or Southeast Asia to access the corporate devices as if they were physically working within the host country. In Arizona, a U.S. facilitator was convicted for hosting laptop farms that managed laptops from over 300 companies, channeling more than \$17 million (approx. 2.5 billion yen) to North Korea over three years. Recently, these laptop farm operations have expanded into European nations, including Romania and Poland.

Post-Termination Extortion: Data Leak Threats and Corporate Damage

When a company detects suspicious behavior and terminates a contract, the situation frequently escalates from employment fraud to a severe cybersecurity incident. In the New Zealand case, immediately following termination upon discovery, the operative claimed to possess highly sensitive commercial data and threatened to leak it unless an extortion payment was made. A warning issued by the Federal Bureau of Investigation (FBI) in January 2025 similarly noted that when North Korean IT workers sense imminent compromise, they swiftly pivot to data extortion. During their tenure, operatives leverage authorized access to quietly exfiltrate organizational assets—copying GitHub repositories to personal storage accounts or harvesting cloud storage session tokens. A notable case involved the security firm KnowBe4, where an operative cleared four rounds of video interviews and background checks, only to attempt installing malware on company systems immediately upon onboarding. Beyond payroll loss, organizations face compounding risks including proprietary trade secret theft, ransomware attacks, and severe regulatory liability for sanctions violations.

The Global Expansion of North Korea’s IT Operative Network

Stolen Identities and Funding the Nuclear-Missile Program

The deployment of North Korean IT workers is not an isolated cash-grab by individuals, but an organized, state-directed campaign to secure foreign currency. Directed by state intelligence and defense bodies—including the Korean People’s Army, the Reconnaissance General Bureau (RGB), and the Munitions Industry Department’s 313th Bureau—elite candidates are recruited from top universities like Kim Chaek University of Technology and rigorously trained in hacking and foreign languages. An individual worker earns an average of \$300,000 per year, while integrated teams generate over \$3 million annually, with up to 90% of revenues siphoned off by the North Korean regime. These funds directly bankroll weapons of mass destruction (WMD) and ballistic missile programs prohibited by UN Security Council resolutions. Compensation is typically received in cryptocurrencies like stablecoins and obfuscated through chain-hopping across decentralized exchanges (DEXs) and cross-chain bridges. The funds are ultimately laundered into fiat currency via OTC brokers and financial intermediaries in countries like Vietnam and Laos before being remitted to Pyongyang.

Bypassing Hiring Filters with Generative AI and Deepfakes

As remote hiring becomes the industry standard, the techniques used by North Korean operatives to bypass vetting have rapidly advanced. Operatives leverage generative AI to automatically craft tailored resumes and portfolio sites that perfectly match job descriptions, while conducting fluid communications in English. During video interviews, real-time deepfake and face-swapping technology are deployed to project the likeness of stolen ID photos onto the candidate in real time. Survey data indicates that as of late 2024, 17% of hiring managers reported encountering malicious interview attempts involving deepfakes. As illustrated in the diagram below, detection rates for interview fraud are steadily climbing:

In addition, a technique known as “identity splitting” has emerged recently. Under this model, the individual who completes the interview process is entirely different from the operative performing daily duties post-hire, rendering traditional interview-stage checks ineffective. Furthermore, individual operatives frequently hold multiple full-time remote engineering positions simultaneously, fraudulently collecting overlapping salaries.

Strategic Countermeasures: Implementing Zero-Trust Controls

Relying solely on traditional database queries for employment background checks is increasingly insufficient against sophisticated synthetic identities and stolen credentials. Organizations must incorporate deeper verification processes, including manual employment history checks and gap analysis on employment records. Essential defensive measures include conducting in-person interviews or utilizing biometric liveness detection during onboarding, alongside strict delivery controls for corporate hardware. Laptops and devices must be shipped exclusively to verified residential addresses listed on government IDs, strictly blocking shipment to freight forwarders or unverified locations. Furthermore, applying a Zero-Trust architecture—”never trust, always verify”—across the entire supply chain is critical. Security teams must monitor corporate networks for connections originating from commercial VPNs, detect unauthorized remote administration tools, and continuously track anomalous bulk data transfers to personal cloud storage. Enhancing human security awareness and governance across third-party vendors and contractors remains essential to countering this evolving threat.

Reference Pages

• [U.S. Department of the Treasury (OFAC) Sanctions DPRK IT Worker Revenue Networks] https://home.treasury.gov/news/press-releases/sb0416
• [U.S. Department of Justice (DOJ) Announces Nationwide Actions Against Illicit DPRK Workers] https://www.justice.gov/opa/pr/justice-department-announces-nationwide-actions-combat-illicit-north-korean-government
• [New Zealand 1News Official Coverage on NCSC Cyber Threat Report] https://www.1news.co.nz/2026/09/24/north-korean-operative-posing-as-it-contractor-hired-by-nz-business/

【#CyberSecurity #NorthKoreaITWorkers #RemoteWork #Deepfake #ZeroTrust #ITInfrastructure】