North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.
Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.
- PurpleDelta applied to 1,100+ companies across software, staffing, consulting, healthcare, and biotechnology sectors.
- Cluster maintained 22 fabricated personas using AI-generated profiles and the TrustID Card identity-brokering service.
- Huntress flagged DPRK workers via Astrill VPN, IPRoyal Proxy, fraudulent documents, PiKVM, and Guermok capture cards.
- Operators used AI transcription and repeated ChatGPT answers verbatim during job interviews.
- Recorded Future assesses PurpleDelta activity is almost certainly ongoing and expanding.
- Tags
- dprkfamous-chollimahuntressidentity-fraudinsider-threatit-worker-schemepurpledeltarecorded-future
- Vendors
- HuntressRecorded Future
- Organizations
- Fortune 500 companies
- Countries
- North KoreaChina
- AI models
- ChatGPT
From the original article
7 min read at thehackernews.com
Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.