North Companies and the Market Impact

- We get like a lot of imposter candidates, particularly North Koreans, like posing as people that they're not. So one of the tests that we do is trying to get them to say Kim Jong-Un is a fat ugly pig. Could you say that for me? - No, Kim Jong-Un. You know, the leader of North Korea. Can you say it?

- Good afternoon, Michael. How are you today? - Hi. Nice to meet you. Hello. - Hi. - Hi. Nice to meet you. - And would you now or in the future require a sponsorship? - I am a US citizen. - You tell people North Koreans are working for American companies, and then the first question is, how's that possible? - From our perspective, it likely is thousands of IT workers who are looking for jobs in the United States. We're talking about millions and millions of dollars going towards North Korea.

- I see them in governments, I see them in defense contractors, I see them at banking institutions. These IT workers are everywhere. - Have you seen the jobs that I've supposedly worked and how much of the money they have made? But yet here I am. Whole life is just took. - They would schedule up interviews and all I had to do was just show up, and then you get one of those remote laptops sent to you.

There's no way I'm the only guy doing this. - Over the last several years, a crop of seemingly perfect job applicants has flooded American companies, but they aren't who they claim to be. They're undercover North Korean operatives. Dispatched by their government, they use stolen identities and fabricated resumes to blast out applications to US-based companies with the goal of getting hired.

Once they do, they pay Americans to set up their company laptops, attend meetings, and open bank accounts. After collecting their paychecks, the IT workers funnel the money back to Kim Jong-Un's regime. Around $800 million a year by recent estimates. US officials say the money helps fund North Korea's nuclear program, and warn that some workers have also hacked their employers. - We've seen massive tech layoffs. We've seen all kinds of coders being put on the marketplace, and then North Koreans are getting jobs?

I don't really fully understand how that's possible except when I think about the fact that they've industrialized the whole process of getting hired. - It's estimated that North Korea has dispatched thousands of high skilled workers to earn jobs with Western companies, and for the last year, the Journal has been investigating one small team of these workers from the inside. We obtained a trove of hacked data from their computers that was sitting in an online archive. It allowed us to see their browser history, emails, stolen identities, and even screen recordings from their meetings.

Using this data, we were able to map out exactly how the team operates. A person using the codename EagleVision acts as the team leader. In videos, we can see three different men posing as the tech workers under three fake or stolen identities. Lucas Lee, Patrick New, and Michael Brown. Though their digital footprint makes it clear they're operating many other aliases as well. They use this private Discord server to coordinate the creation of resumes, cover letters, and other hiring materials for the various applicant aliases they're utilizing. To prepare for interviews, they assemble Google Docs like this one

which shows them getting ready for conversations with four different companies using three different applicants' names. They also do other homework, like looking up how to pronounce their cover names. - So these IT workers are following the North Korean IT worker playbook to a tee. So the IT working team, like the composition of them is gonna vary. You're going to have a boss. You might have someone that's better at interviews where those people are strictly 15 interviews a day, you have people that work on resumes, you have people that actually do the job.

There's many different roles. It all depends on who's going to be what. - In just over three months, this small team applied for jobs at more than a thousand companies. A snapshot of EagleVision's Google Calendar from January 2025 reveals what appears to be 22 job interviews using at least seven identities, and that's just one week. Our investigation found the team was hired for at least nine jobs across companies in the US and the UK. The North Korean team often records its members, possibly for training or surveillance purposes as they conduct meetings and job interviews.

This screen recording shows how they used AI to cheat their way into companies. Before an interview begins, we can see an IT worker teeing up ChatGPT and asking it for help answering questions related to a software engineering role. - Hello. - Hi. Nice to meet you. - Do you have any experience with Lambdas? - Yeah, of course. - The worker copies the interviewer's question from a transcription tool, pastes it into ChatGPT, and then reads the response verbatim. - I've used it for handling background tasks, and triggering workflows, and processing API requests in a cost-efficient way.

- We tracked EagleVision down on the messaging app Telegram. He told us we had the wrong person and declined our request for an interview. - Once they have the job, then they have to get their work computer. The companies typically will send you a laptop that you're gonna be working on. It's your corporate laptop, it's locked down, secure, all this stuff. If they were sending that device to Pyongyang, that would raise red flags. But if they send it to say, Phoenix, Arizona, not so weird. So where do they send the laptop?

They need a partner within the United States that can receive those laptops. - Our teams so far have arrested or charged 39 individuals, both IT workers and US persons, who enable the IT worker ecosystem that happened. - The biggest laptop farm we've uncovered to date had about a hundred. So even that, if every laptop farm has dozens, we're talking about thousands of Americans would have to be involved for this to function. - It's important to note too that some of those folks are witting. Some of those folks know that they are circumventing US law, they know that they are at the very minimum circumventing policy within those organizations.

Now, there's many people who also don't. They're unwitting. - If I'm arrested, what would I be arrested for? All I did was handle a job that was in my name and somebody else was coding for me. The illegal parts, I don't wanna associate with it. Like, that's just not me. - Derrik Goon has spent the past several years working as a facilitator for EagleVision. When we tracked Derrik down, he said he was paid to run a laptop out of his home in rural Ohio, but he told us he didn't know that EagleVision was North Korean.

- Ah, here we go. Here's one. - Hello, Derrik. This is EagleVision's friend. Please check your laptop. After yourself right now. - Because Derrik has a programming background, EagleVision's team sometimes applies for jobs under his real name, and then he shows up for the interviews himself. If he gets the job, Derrik says he runs the laptop and attends meetings while EagleVision's team does the work behind the scenes. Then, they split the salary. - They would schedule up interviews and then I'd sit and do these interviews with 'em.

All I had to do was just show up and, you know, land the job. Then you get one of those remote laptops sent to you. It's not any more difficult process than that. Like, it's a remote job. You know, I get to live more free, I guess. I can go to school full-time and then still carry this out. You know, it alleviated a lot of stress for me. - Times are rough right now so there's always gonna be someone who needs cash so they can use money as an enticement, but also they liked 'em interesting and I feel like any facilitator I've ever seen,

I think they all are very, very weird and unique and maybe a little bit more manipulatable. - I dropped out of high school and I started my own business. It was like a Bitcoin virtual currency exchange for like video game gold and stuff like that. I had an addiction to heroin back in like 2013. Got thrown in jail three or four times. Like, right now, it's kind of difficult to get some like employment. I mean, I've been talking to these guys since like 2020 really.

I kept getting bugged by people through Telegram, but he's like, "Hey, I want you to talk with this guy. I think he's gonna end up being able to help you out given your situations and stuff." At first, like I thought, like he said he was from Brazil in the very beginning, and you're like, I'm leery about it at first, but, you know, after talking for a little bit back and forth, I was like, "Yeah, you know what? Let's give it a shot." Like lo and behold, like, it ended up actually doing pretty good. I mean, I've had a passive income for the last year and a half now. In a broader perspective, I'm like, how big is this really?

'Cause I mean, I think it could be a lot larger than I thought. - North Korean IT workers are scattered across the globe. One report estimated there were 1,600 to 3,000 total in 2025 with the majority based in China, where they rely heavily on the country's infrastructure, financial institutions, and facilitators to carry out this fraudulent work. - The actual workers operate in jurisdictions where the US can't touch them. So they're working out of North Korea, or they're working out of China, or they're working out of Russia.

These are countries that if the FBI says, "Hey, we've identified some criminals there. Would you send them over to the US?" They will say no. - We traced an IP address tied to EagleVision's team to Shenyang, one of the Chinese cities that's become a hub for these IT workers, in part for its proximity to the North Korean border. - One of the things that makes this such an interesting story is North Korea is like incredibly innovative. Their hustle, it just seems to no end.

The sanctions have been around for so long that it's easy to forget that North Korea once had an economy that interacted with the rest of the world, and over the last decade, North Korea has shown its creativity and focusing on ways of getting money into the country. North Korea's entrance into the world as a hacking superpower basically started not for money, but started with the Sony cyber attack where they were upset about a film being released. Shortly after that, North Korea pivoted to making money. There's the Bank of Bangladesh hack where North Korea stole a billion dollars, but they stole it on the traditional financial system, and a lot of that money got clawed back. After that hack, they pivot

and they start getting an interest in cryptocurrency, and crypto hacking started taking off. Then COVID happens, and everybody moves to remote work. The North Koreans sensed an opportunity. If you're never showing up at the headquarters, maybe you don't have to be who you say you are. Maybe there's an opportunity to pretend you're somebody who's legitimately employable, get a job, get a paycheck, get a six-figure paycheck.

It's a coding job, you know? They started focusing on getting into crypto companies and trying to use their position as workers there to undermine the products and to steal money from them. Then I think at one point they were like, "Hey, we're getting paychecks for doing this. Like, why don't we just do this everywhere?" - The North Korean regime did not respond to our request for comment. But in early August, a foreign ministry spokesperson dismissed allegations from the international community regarding the IT worker scheme as false information devoid of credibility.

- One of the things that's remarkable about this scam to me is that a lot of the victims are just regular Americans who have no idea that even now they're being victimized. They're the people whose identities are stolen to perpetuate this fraud. - Hello, thank you for calling. How can I help you today? - Good afternoon. - What was your first and last name? - Michael Brown. M-I-C-H-A-E-L Brown. I am calling because you guys actually supposedly had me working for you guys.

My identity was apparently used. - Just because of multi-nature department, I can only give you very basic information. - What basic information are you able to give me? - I am only able to confirm like employment dates. - Okay, awesome. Thank you so much. How much liability can you really get if the person who's calling is asking for his own personal information? But I get it too 'cause hey, it's not like you in person, you're here in person so you can be anybody

saying you the real Michael Brown. Hell, hey, that's why we're here today. - We found Michael's identity for sale on Telegram, a messaging platform EqualVision uses to find new aliases though Telegram says it forbids the sale of private data. North Korea has developed strategies for stealing identities at scale. This document found on the computer of a different cell of North Korean IT workers offers guidance on how to acquire stolen identities.

The document instructs workers to purchase an identity from a website that sells stolen personal data, and utilize several tools, including e-Verify, a US government website, to check if the stolen credentials will pass background checks. Finally, use the credentials to purchase a driver's license from a company called TrustID Card, which added a notice to its website after we reached out to say it only makes souvenirs. - I was informed my identity was being used when I went to the Department of Labor to check on unemployment. The lady just so happened to see that I had multiple jobs around about the same time in completely different states. So it was more like,

"Hey, are you working all these places?" And I'm like, "No, I've been working for the same place for the past two years." How you been? - Good. How you been? - That's my investigator right here. - 11 states. - Yep. - Okay. - It's magic. I can teleport. - So those are all of the Georgia. California, Florida, Georgia, Illinois, North Carolina, Texas, and Tennessee. - She gave me the paperwork and I seen all these jobs that I had no clue about, and I'm just like, "Oh." So I remember making a joke with her like,

"Hey, at least my social security is gonna be nice." You ladies have a good one. Hopefully I don't have to see me again. - The Department of Labor's records showed Michael working at nine different companies he said he's never heard of, amounting to $100,000 in income he said he didn't receive. While it's unclear whether North Korean IT workers were behind these jobs, we found evidence of them using Michael's identity to work at two other companies. - Tim, I just wanted to introduce you to Michael Brown as well while we're getting a chance to chat, and, you know, Michael's an incredible gentleman

and we've gone through his background as well, and I think this is a really great conversation for both of you to have in regards to what you need for your team. - In early 2025, father and son Tim and Charlie Richardson worked with a recruiter to hire a software developer for their startup, Visual PT. - The recruiter had told us that his English wasn't good, but once you reviewed his code, there was a sense like, hey, this guy might be our guy.

- Yeah, I'll send you that link right now and take your time with the research, but hopefully - - Well, not too much time. - In the next two or three days, you'll have fully understood the problem. When we saw that, I was like, "Okay, well, this guy, Musa, the recruiter, sent us a perfect candidate." - That is one of the ways that this has also grown over time is the aggregation of a lot of these applicants into some of these third party companies who specialize in recruiting IT talent.

- They serve as a force multiplier. Like, you can submit one application, and then this company will send them for hundreds of open jobs, and so that makes it easier and the companies work on volume so they're more interested in, you know, placing individuals rather than vetting them. - We've seen this at governments. We've seen this at our government. They got in and they got in because a third-party service they didn't do their due diligence and they hired an IT worker. - One final question. Michael, do you have any. How's your status for work in the United States? Citizen. Okay, perfect. That helps a lot.

I'll be darned. - So this is what I was telling you is he seemed legit because his responses were quick enough. - The Richardsons didn't find out that the contractor they'd hired was misrepresenting himself until we reached out to them for an interview. - My mind is blown right now. My sense that the resume was probably also false, the interview was false. Initially, I thought maybe he was just lazy or just sloppy, and now I realized there was mal-intent. These people are out there apparently feeling like they can do this with no repercussions, no consequences. - It affects your livelihood.

Applying for jobs, applying for loans, applying for a house, a car. Anything that requires my social is pretty much gonna be an issue for me. So this is Voya Financial, a DT Consulting 401K plan summary plan description. They opened up a 401K in my name and all. Like, bro, that is wild. - It turns out, while fake Michael Brown was working for DT Consulting, he was contracted out to another company, Amazon. Amazon told us more than 2,900 suspected North Korean operatives have been blocked from joining the company since April 2024.

The company said it has never directly hired a North Korean IT worker. In rare cases where a third-party contractor's employee used a fraudulent identity, Amazon said it worked with the agency to remove them. - It is mind-blowing. Have you seen this man resume? Oh my God, have you seen the jobs that I've supposedly worked and the little amount of time they work and how much money they have made? But yet here I am. Whole life is just took. Somebody else is living like me right now. - We've seen some IT workers who make upwards of $300,000 a year.

The Treasury Department identified that in some cases, up to 90% of their income actually goes back to the regime. The individuals themselves are not making a lot of money, but in aggregate we're talking about millions and millions of dollars going towards North Korea's WMD and missile development programs. Their goal is to avoid detection when they get the money out of the country. - The money earned through this scam typically follows a complicated and multi-step journey back to North Korea. Often involving an assortment of foreign bank accounts, couriers, crypto transactions, and money launderers.

- Cryptocurrency is one of the best ways for actors to move money in general, and so that's an avenue that the North Koreans recognize as a lower risk way to transit countries who would normally look to disrupt the movement of those funds. - They want crypto so like, we'd send them like 600 bucks in crypto and I'd keep the rest and it's always the same amount, same salary. This one's a 75K a year salary so my cut is 50%. I mean, yeah, they're pushing a lot of money. Like, it's a pretty big operation from what I've seen.

- EagleVision's browser history led us to a cryptocurrency wallet he was using to send and receive payments. We traced where the money moved and found that EagleVision was just one node in a vast North Korean financial network, which includes wallets associated with an $11 million crypto heist, as well as IT workers who sent payments through a platform used to collect money for the regime. Cybersecurity researchers traced some of these payments to Ryonbong, a company sanctioned by the US for its role in Pyongyang's weapons program.

- Now that they have this cash, they could spend it on virtually anything. The US government does like to point out that they're using it to fund their nuclear program, but it could be used for any purpose. - Morning, Derrik. - Good morning. - How you doing? - Doing a little bit better. - The same worker who was hired by Visual PT and Amazon under Michael Brown's identity also worked under a different name at a British tech company called Subly. - If you're going to have a sick day, you need to tell us before 9:00 AM because we need to shift everything. - Yeah. - Not good, man.

- Yeah, also, I'm still not fully confident about like your performance. I know you have the expertise, but I am missing all the kind of like communication skills. - This is also the same people that are working 18, 20 hours a day. You also have to factor in the human element of like, they're tired. You know, these guys are working around the clock and using AI and all these scripting, but also they're humans too, and everyone makes an error.

- In many ways, the IT workers themselves are victims of the regime because they're being forced to work multiple jobs in a place they can't leave, and, you know, if they do try to leave or defect, their families are threatened. They're basically slave labor for the regime to generate money. - These guys are picked up at ages seven, eight years old. If you have a high aptitude for science, math, problem solving skills, you're gonna get pulled in at that early of an age. So by the time these guys are 18 years old, they've had cyber training, they're completely schooled, they've been vetted.

The more privileged IT workers like what we see them living a little bit better life, having, you know, a steak dinner at times. Whereas you have more of the general use IT workers where there's six of them crammed in one room. - We've heard that sometimes they're great employees and often they're not. Sometimes they're terrible employees, and the whole scam seems to be just to get like a couple of weeks paycheck and then move on to the next victim.

I mean, over the past year, this has become one of the top three or four cyber issues in the United States. So people are paying attention to it. They're finding these workers more quickly than they were. - Where are you based? - I live in Pendants, you know? - Where are you based? All right, getting blindsided. - What's the weather like now? - It's really good, but yeah. - Okay, yeah, so I feel like the recruiter's getting suspicious now.

He's like, "Where are you at?" And then he's like, "What's the weather like?" So now he's like, now I feel like he's figuring it out. - Hiring teams have started looking for red flags to identify fake applicants. - Is it cold? Hot? What's the temperature roughly, yeah? - And then this panic. What is the weather like? - Is it cold? Is it warm? What's the temperature right now? - This is pretty funny.

- It's really cold, yeah. About 10 degrees celsius, yeah. - See, the biggest trend is now trust but verify. If we're all gonna be working remote, which is perfectly fine, I need to make sure that the remote worker is who they say they are. A lot more verification is going on across the board and I think it is hurting their operations, but they don't just pack up and go home. It's gonna be how do they adapt and then how do we adapt against that? - Your avatar is like kind of weird. Like, are you using something to change your camera view?

- On LinkedIn, you would see these videos of these North Koreans conducting interviews, but it was like an AI avatar. It wasn't a real North Korean. People would be conducting interviews and they'd realize that there's something wrong with this employee. - Getting North Korean's faces off camera is huge for them. Next year, we will be talking about where did all the IT workers go? I can't find them anymore. So the years of us being able to see the IT worker on camera, they might go away.

- As their face swapping techniques have improved, making them harder to detect, they're developing new methods to scale their operation, like subcontracting the actual IT work. - This is a huge evolution. They're gonna get the job and then immediately repost the job for a smaller price and just get a butt in a seat. They're acting as middlemen. We saw one North Korean had subcontracted that work to someone in the Middle East. It was a $5,000 job, and the facilitator that did the actual work at $500.

- One tactic that's helped them to both escape scrutiny and increase capacity is to train more facilitators to show up for the interviews. Here's the recruiting pitch from one North Korean worker we spoke to. - But this language gap sometimes makes it harder for us to win new projects. That's why we are looking for a fluent English speaker who can step in during the interviews. - They're looking for more people like Derrik. In the past, Derrik interviewed for jobs as Derrik Lee, his real first and middle name. But sometimes he uses fake names assigned to him by the IT worker team.

He also said EagleVision has asked him for help recruiting more facilitators. - Yeah, he asked me and he's like, you know, I'll throw you like a, you know, 500 bucks or something if you find me somebody, and I was like, "Yeah, I could probably find one or two people." - But over the months that we've been in touch with Derrik, he's begun to accept that he's been roped into a North Korean employment scheme. - Well, when I mentioned something, I was like, "Yo, dude, you in North Korea or something like that?" He got really pissed off at me when I said that.

He says, "No, why would you even think that?" And I was like, "Well, because I got some sources that say you were." - Recently, Derrik found out that EagleVision has been using his identity without his permission. A 1099 form he received from Upwork showed nearly $100,000 in freelance income he thinks went to the North Koreans. - He's been me over. My moral compass is starting to lean more towards like, dude, these guys are in a shadier business than I thought. I mean, how the do I get involved in shit like this, man?

- Hello, Derrik. How are you? - Hello? Yes, this is Derrik. - Derrik sent a few additional screen recordings from the laptop he ran for EagleVision, including one where a worker poses as him and uses an AI tool to change his appearance. - Where are you based out of, Derrik? - Ohio. I'm based in Ohio. - Oh, nice. - The journal reached out to the nearly 300 companies, recruiters, and hiring managers appearing in this documentary. Many did not respond, declined our request for comment, or denied knowingly hiring anyone using a stolen or fake identity.

Others said they moved quickly to root out bad actors or illegal activity, and many mentioned taking steps to avoid these issues in the future. One company we found to have employed an IT worker told us they had already cooperated with an FBI investigation into the issue. - We're under no grand illusion that we're gonna arrest our way out of this problem. Like, law enforcement action alone is not the solution here.

It is part of the solution. The only way to get out of this problem though, is to pair those law enforcement actions with corporate hiring practices, corporate vetting practices, industry flagging this to corporations to help prevent this as well. Corporations flagging it to the US government. - Meanwhile, these North Korean workers are moving into other kinds of work like civil engineering, and they're branching out to companies across the globe. - Companies are willingly giving usernames and passwords, keys to these workers to get into their networks. Now, right now, primarily we've seen this as a revenue generation issue.

The biggest concern we have is that this can quickly pivot into an espionage issue, theft of intellectual property, potential sabotage when you're working in critical networks, supporting critical infrastructure. - Well, now they're doing a lot more of that intellectual property theft, data extortion, things like that. So I see them in governments, I see them in defense contractors, I see them at banking institutions. What keeps me up at night is that these IT workers are everywhere. They're absolutely everywhere, and at a moment's notice, if Kim Jong-Un gives the word, he can have them try to blow it up from the inside all at the same time.

- Car keys. I've seen 'em. Ah, I know where they are. - Right there. - Auntie, you are no help at all. - Michael received a letter in October 2025 informing him he was a victim in an identity theft case that involved the production of fake IDs, but he struggled to access resources and sort out how widely his identity is being used by the North Koreans and possibly other scammers. - I love you, baby. Have a good day, all right? I've been blacklisted so I can't get a bank account.

Hell, I can't get a rental property in my name. So until I guess I get some type of resolve from this or some type of answer, some type of information, then life can start back, I guess, moving normally on that side. The most people can say is, "Well, yeah, you gonna have to make some calls and get this fixed, and now you finna have to answer a million questions like you're the one who stole your own identity." And it's like, so what do you do at this point?