North Korean IT Workers Infiltrate US Companies Using AI and Stolen Identities
North Korea is reportedly building a secret workforce that infiltrates American companies. Using stolen identities, artificial intelligence (AI) tools, and accomplices on the ground in the United States, these operatives secure remote jobs to funnel funds to Kim Jong Un’s regime.
The FBI states that thousands of such workers have applied for jobs across America. A year-long investigation by The Wall Street Journal, detailed in a documentary titled ‘Infiltrated: North Korea’s Secret U.S. Workforce’, uncovered the workings of this cell based on leaked data, including browser histories, emails, and screen recordings from their own computers.
The tracked cell applied to over 1,000 companies in just three months, using AI at almost every stage. They used AI to write convincing cover letters and resumes. Screen recordings showed the workers reading answers directly from ChatGPT during live interviews.
When hiring managers began to catch on to these tactics, the North Korean workers started using AI-powered face-swapping tools to manipulate their appearances, making detection during video interviews even harder.
To avoid the suspicion that would arise from shipping company laptops directly to Pyongyang, the IT workers pay facilitators in the United States to host the devices. The workers then connect to these machines remotely. These facilitators, some knowing and others unwitting, also help open bank accounts, cash cheques, and even stand in for interviews. In one case in Ohio, a man admitted to attending company meetings while the North Korean operative did the actual work. For a job paying US$75,000 a year, they split the income 50/50.
To pass background checks, the operatives use stolen identities of American citizens. They often run multiple aliases simultaneously and hold several jobs under a single stolen name. The damage to the real identity holders is severe; one man in Georgia whose identity was sold online can no longer open a bank account, apply for a loan, or rent a home because his name has been tainted by the illegal activity.
The financial scale of the scheme is significant. Some North Korean IT workers can earn up to US$300,000 per year. The US Department of the Treasury found that up to 90% of their salaries are remitted back to the North Korean regime. Recent estimates suggest the operation generates up to US$800 million annually. This money is traced through networks of IT workers and cybercriminals, ultimately reaching companies sanctioned by the US for their links to Pyongyang’s nuclear and missile programmes.