A new investigation has exposed an elaborate North Korean employment operation that uses fake companies, fabricated identities and remote hiring to place IT workers inside Western businesses. The operation shows how Pyongyang has turned ordinary recruitment into a source of illicit revenue and potential corporate access.
A joint investigation by IBM X-Force and Flare Research found evidence of a structured network involving recruiters, facilitators, IT workers and Western collaborators. Researchers said the broader operation could involve as many as 100,000 North Koreans across roughly 40 countries and generate about $500 million a year for Pyongyang.
How the fake startup worked
At the center of the recruitment process was an alleged stealth startup called C Digital LLC. Recruiters reportedly told candidates that the company was still in its early stages and had little public information.
However, the candidates were not simply being hired to build a new technology business. Recruiters coached them to seek jobs at legitimate Western companies, often using U.S.-based identities.
Some candidates appeared unaware that the arrangement was connected to North Korea. Interview recordings reportedly showed confusion when recruiters asked them to adopt more American names. That distinction matters because some workers may have entered the scheme believing they were joining an unconventional recruiting operation rather than assisting a state-linked fraud network.
The crypto connection
The operation has particular significance for cryptocurrency businesses, which frequently rely on remote developers, contractors and global freelance platforms. North Korean operatives have previously secured positions at blockchain and crypto projects using fake or stolen identities.
Once hired, workers can generate legitimate salaries while potentially gaining access to source code, internal systems and sensitive business information. U.S. authorities have also linked cryptocurrency addresses to facilitators of North Korean IT-worker fraud.
The investigation underscores a growing problem for crypto startups. A sophisticated attack may no longer begin with malware or a compromised wallet. It can begin with a seemingly ordinary job application.
