In September 2025, Okta Threat Intelligence published research from a large-scale analysis into fraudulent employment schemes conducted by Democratic People’s Republic of Korea (DPRK) IT Workers (ITW). 

That research collated data from over 130 actors, conducting over 6500 interviews with 500 companies. 

In this post, we look specifically at the activities of two individual personas. We selected these two examples from a large list of actors that we continue to track because they exemplify the typical tools, techniques and procedures (TTPs) employed by DPRK ITW actors. Additionally, each had novel observables that can further inform defenders against these efforts.

These two actors reveal two interesting TTPs DPRK actors use to land employment: the abuse of legitimate LinkedIn profiles to pass reference checks, and the abuse of stolen identities.

#1 - Meet “JJ” 

The first of the two actors we will detail we’ll refer to as “JJ”. This actor has prolifically interviewed for roles in multiple verticals over two years, with an overrepresentation of roles in AI and healthcare.

The email account used by this actor is similar in structure to other DPRK-linked actors, in that it utilizes a free webmail service and the account name incorporates references to software development and other randomized alphanumeric characters. Open-source intelligence (OSINT) research conducted into the email address used by this actor uncovered a number of online services accounts that are very typical of DPRK ITW actors. All of these accounts are used exclusively for job applications and associated tasks:

• Job board and hiring platforms

• Scheduling platforms popular with recruiters

• Document organization workspaces with AI assistance

• Dynamic DNS services

• Online coding platforms

While not observed with this specific actor, Okta Threat Intelligence has also used OSINT techniques to observe email addresses used by DPRK actors being registered to the following services: 

• Freelancer employment platforms

• Article authoring and publishing platforms

• Document creation and managements

• Language learning platforms

• Online communications

• Software development social platforms

• Online PDF platforms

• Coding assessment platforms

DPRK actors use these online accounts and fabricated resumes to effectively create an artificial “persona”. These personas appear "out of thin air", inheriting the online presence required for a professional applying for roles, but without any evidence of personal use of any internet services. The exclusive use of these specific services, combined with the absence of any personal online footprint, creates a pattern highly indicative of an artificial persona.

Additional “tells” very common to these actors can sometimes be observed in the document properties of PDF résumés they provide. Okta Threat Intelligence can provide customers with further details on these methods of detection - please talk to your account manager to find out more.

#2 "EM" gets hired

We will refer to our second actor as "EM". EM’s employment fraud activity stretches back over a year, with hundreds of interviews again across all verticals, but very much favoring AI-related roles and organizations. Okta Threat Intelligence also observed EM interviewing with sensitive critical national infrastructure (CNI) organizations such as commercial aviation, communications providers, internet service providers, a voting technology company and intelligence and defense contractors. 

EM has a statistically high occurrence of succeeding in first interviews and being offered  multiple rounds of interviews with individual organizations, and is likely to have been hired by several organisations into software development roles. 

We set out to discover some of the secrets to EM’s success.

The co-opted persona used by EM appears to have been crafted based on an online photograph of a legitimate person who unfortunately also displayed enough information online to enable the DPRK (and potentially others) to co-opt his identity. 

Conclusion

Just as with genuine candidates hunting for work, the vast majority of interviews with DPRK facilitators and agents do not progress to a second interview or job offer. 

Some actors however seem to be more competent at crafting personas and passing screening interviews. Their skill isn’t limited to an ability to impress a prospective employer, but also to the tools and techniques that DPRK ITW actors use to try to obfuscate their actual origins. 

Given the vast quantities of job applications and interviews being conducted, the various operators in the IT Worker scheme are clearly “learning from their mistakes” - in many cases duplicating approaches (CV structure and elements, Linkedin profile construction and interview support technologies) that have succeeded in progressing one application over another. A kind of IT Worker natural selection is at play. The most successful actors are very prolific, and scheduled hundreds of interviews each. We consider it likely that they often act as “interview brokers” in order to land employment positions that are then handed over to other DPRK ITW actors.

Steps to take to counter this threat

Okta Threat Intelligence assesses that organizations across all verticals — particularly those advertising remote or contract roles — should adopt a layered and proactive approach to recruitment, onboarding, and insider-threat monitoring. Okta recommends that organizations:

1. 1. Strengthen applicant identity verification

• Require verifiable government-issued ID checks at multiple stages of recruitment and employment

• Cross-check stated locations with IP addresses (include VPN usage detection), time-zone behaviour, payroll banking information and delivery addresses provided for shipping hardware.

• Use accredited third-party services to authenticate identity documents, prior employment, and academic credentials
   

  2. Tighten recruitment & screening processes

• Train HR and recruiters to identify red flags. Encourage processes that would identify whether a candidate is swapped out between rounds of interviews. Teach them to identify behavioural cues such as poor knowledge of the area they claim to reside in, a refusal to meet in person, a refusal to turn on camera or remove background filters during interviews, or interviewing using a very poor internet connection. Identify duplicated résumés, inconsistent timelines, mismatched time zones and unverifiable references. Assess the candidate’s online footprint and social media presence against the information provided. Where evidence of previous work is provided, investigate whether these projects were simply cloned from the repositories of legitimate user profiles.

• Verify the history of edits to CVs and PDFs in document metadata and other technical “tells” associated with duplication and reuse.

• Add structured technical and behavioural verification (live coding or writing performed under recruiter observation).

• Require corporate email references (not free webmail) and confirm via outbound call to the main switchboard numbers of the reference organization. Ensure these references incorporate elements other than revealed in for example public LinkedIn profiles, such as last-manager’s name.
   

  3. Enforce role-based and segregated access controls

• Default new or contingent workers to least-privilege profiles and unlock additional access once probationary checks are complete.

• Segment development, testing and production; require peer review and approval workflows for code merges and deployments.

• Monitor for anomalous access patterns (large data pulls, off-hours logins from unexpected geos/VPNs, credential sharing).

• Employ access certification campaigns to govern ongoing access.
   

  4. Monitor contractors and third-party service providers

• Where possible, contractually mandate ongoing identity verification standards, background checks, strong authentication policies, device-security baselines and rights to audit.

• Require named-user accounts (no shared logins or internal service accounts where possible) and separate tenant/project access for each client environment.
   

  5. Implement insider-threat and security awareness programs

• Establish a dedicated insider-risk function or at least a working group spanning HR, Legal, Security, and IT.

• Provide targeted training for recruiters, hiring managers, and technical leads on ITW tradecraft and screening controls.

• Educate and empower hiring managers and staff members to observe and submit reports of potentially strange behaviour by their peers that raise questions as to their identity, goals, and locations. 

• Create safer reporting channels for suspicious behaviour or candidate concerns.
   

  6. Coordinate with law enforcement and industry peers

• Share indicators of compromise and suspicious candidate patterns with national cybercrime units and ISAC/ISAO groups.

• Develop methods for the “insider-risk” group to receive and action indicators (email addresses, IP addresses, VPN providers, document creation, and behavioural indicators) and be prepared to “share back” relevant findings.

• Actively participate in information-sharing forums to track evolving ITW tactics and tooling.
   

  7. Conduct regular risk assessments and red-team exercises

• Model insider and malicious contractor attack paths; quantify potential business impact.

• Perform red team exercises that test the hiring pipeline (simulated DPRK application and interviews) to assess identity verification processes.

• Update incident response plans to include scenarios involving malicious insiders, compromised contractors, and expedited access revocation.
   

Okta Threat Intelligence appreciates the assistance of Epieos in the research for this post.