North Korean IT Worker Accused Of Using Stolen Identity For Job Scam

In June 2025, cybersecurity firm Nisos uncovered a sophisticated employment fraud scheme when a suspected North Korean IT worker attempted to infiltrate their company.

The operative applied for a remote Lead Artificial Intelligence Architect position using the stolen identity of a real Florida resident.

Through open-source intelligence and targeted interview questions, investigators exposed a complex network involving stolen personal data, artificial intelligence, and a physical laptop farm.

Deceptive Application Tactics

The threat actor used a combination of stolen personal information to appear as a legitimate American applicant.

This included a newly created email address and a Voice over Internet Protocol phone number. Scammers frequently use internet phone numbers to match the local area codes of their stolen identities.

During background checks, investigators found three different resume profiles online using the same name.

However, these profiles listed conflicting details, such as attending either Florida Atlantic University or the University of Florida, as well as different past employers.

Technical Indicator	Details
Threat Actor	Suspected DPRK IT Worker
Known IP Addresses	167.88.61.250, 167.88.61.117
Anonymization Tool	Astrill VPN
Hardware Used	Raspberry Pi-based KVM (PiKVM)
Network Security	Tailscale Mesh VPN

Exposing The Laptop Farm Network

To investigate the threat further, the company mailed a corporate laptop to the mailing address provided by the operative.

This address differed from the stolen identity’s actual home, a common indicator of workforce fraud. Location tracking and photos taken from the laptop’s built-in camera revealed it was placed inside a closet alongside many other computers.

This setup is known as a laptop farm, typically hosted by willing participants inside the United States to help foreign workers bypass corporate location checks.

Technical analysis of the farm revealed advanced remote access methods. The operatives masked their true location using the Astrill virtual private network, connecting through specific IP addresses previously linked to North Korean cyber activity.

More importantly, the operatives used PiKVM devices to control the machines. A PiKVM is a hardware tool that provides full remote keyboard, video, and mouse control over a computer.

Because it operates independently and connects before the operating system even boots, it allows threat actors to maintain stealthy access without triggering standard corporate security software or endpoint detection systems.

Furthermore, the compromised network was linked using Tailscale, a mesh virtual private network service.

This hubspotusercontent enabled North Korean operatives to establish secure, encrypted connections across multiple devices for remote command execution and data theft.

Investigators discovered about 40 devices running on the farm, each machine logged into different corporate networks using various fake employee names.

Companies must recognize that hiring individuals linked to these fraud schemes can expose organizations to severe data breaches, regulatory fines, and loss of customer trust.

Successful mitigation requires an improved vetting process for remote candidates and partnering with intelligence firms to quickly identify insider threats.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post North Korean IT Worker Accused Of Using Stolen Identity For Job Scam appeared first on Cyber Security News.