Threat actor

North Korean IT workers

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 20, 2026 · last 2h ago

Timeline2 articles

North Korean IT Workers Pay People to Sit Through Job Interviews While They Control the Computer

Silent Push found North Korean IT workers recruiting on-camera proxies for job interviews while remotely controlling the computer, defeating identity and location checks.

Silent Push researchers engaged the "Tec Guru" persona via Discord and Telegram and assessed with moderate-to-high confidence that the operator is a North Korean IT worker recruiting on-camera proxies in the US, Europe, and Latin America for a 35/65 revenue split. During Google Meet interviews, the proxy stays on camera while the real worker supplies answers via ChatGPT-generated prompts, real-time messaging, or remote-control tools such as AnyDesk and TeamViewer. Successfully placed workers can access source code, cloud tenants, and CI/CD systems, and payments create sanctions exposure; the US, Japan, South Korea, and eight other governments issued a joint identity-verification alert on July 31, 2026.

GBHackers12:51 UTC · 2h agoPhishing & fraud in the wild 2 sources

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUNAug 20, 07:58 UTC · 28d agoThreat actor

Appears with

ai model ChatGPT 1 organization Silent Push 1 product ChatGPT 1 product Discord 1 product Google Meet 1 product Telegram 1 vendor AnyDesk 1 vendor ANY.RUN 1 vendor Astrill 1 vendor TeamViewer 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.