North Korean Scammers Infiltrate Healthcare and Finance Sectors
North Korean workers using fake identities to infiltrate global companies for illegal activities.
1New Targets for North Korean Scammers
Threat actors linked to North Korea are seeking job opportunities beyond the information technology (IT) sector, infiltrating healthcare and finance industries. Recent investigations reveal that these workers, using fake identities, are remotely employed by global companies to fund Pyongyang's illegal nuclear weapons programs. These operations rely on stolen or forged identity documents, VPNs, and proxy services.
2Fake Identities for Employment
North Korean workers secure jobs at Fortune 500 companies and private sector firms using stolen identity information and fake documents. For instance, in February 2026, three employees at an Australian healthcare company were found using Chinese identities. These employees connected via Astrill VPN and IPRoyal Proxy.
3Role of Technological Tools
North Korean workers use KVM switches like PiKVM and TinyPilot to remotely connect to devices hosted on laptop farms. Additionally, Guermok USB capture cards are used to enable video streaming in web conferencing applications like Zoom. These techniques increase the complexity of their operations.
4AI-Powered Fraud
North Korean workers utilize artificial intelligence (AI) tools to create fake identities and generate real-time responses during job interviews. For example, they repeat ChatGPT responses verbatim to appear credible in technical roles. AI-generated profile photos and identity documents facilitate their fraudulent activities.
5Risks Faced by Companies
North Korean workers record internal company meetings and use Google Translate to draft pre-written excuses for using personal devices and bank accounts for work. This increases companies' security vulnerabilities and leads to financial losses. Companies must conduct stricter background checks during the hiring process.
6Global Spread of Operations
The operation, known as PurpleDelta, applied to over 1,100 companies between 2024 and 2025. These companies operate in software and technology, healthcare, and biotechnology sectors. The operation is managed by operators based in China and uses 22 fabricated identities, sourced from illicit ID-generation services like TrustID Card.
7Challenges in the Hiring Process
North Korean workers use screen recording software and AI transcription tools during job interviews to generate real-time responses. These tools help them appear credible in technical roles. Companies can mitigate this risk by conducting standard background checks and online research during the hiring process.
8Future Threats
The activities of North Korean IT workers are becoming more complex with the integration of AI tools. Custom ChatGPT assistants, real-time AI transcription, and AI-generated profile photos facilitate fraudulent activities. This trend could lead to larger and more sophisticated operations in the future.
Original article: The Hacker News — Kuzey Koreli Dolandırıcılar Sağlık ve Finans Sektörüne Sızdı