{"id":2622,"date":"2026-08-31T18:24:01","date_gmt":"2026-08-31T18:24:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2622"},"modified":"2026-08-31T18:24:01","modified_gmt":"2026-08-31T18:24:01","slug":"north-korean-job-fraud-expands-beyond-it-into-healthcare-and-sales","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2622","title":{"rendered":"North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales"},"content":{"rendered":"
\n
<\/a><\/div>\n

Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession.<\/p>\n

The ongoing insider threat is part of what has been described as the IT worker scheme, where North Korea leverages its network of skilled IT workers, both within and outside the country, to fraudulently land jobs in Fortune 500 companies and private sector firms across the world and remotely earn income to further Pyongyang’s unlawful nuclear weapons and ballistic missile programs.<\/p>\n

This entails relying on stolen or forged identity documents, VPNs, and proxy services to mask their true identity and location. The yearslong campaign is also tracked under the monikers Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta (formerly TAG-121), UNC5267, and Wagemole.<\/p>\n

\u00abDPRK workers present a unique detection challenge for defenders: rather than compromising accounts or breaking in via gaps in the organizations’ environments, they’re tricking companies into remotely hiring them, and oftentimes actually doing the legitimate work they were hired to do,\u00bb Huntress said<\/a> in an analysis.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In one case in February 2026, three employees of an Australian healthcare company were flagged as North Korean workers impersonating Chinese individuals after they were found repeatedly connecting through Astrill VPN and IPRoyal Proxy, fraudulently created identity documents, similarities between two of the employees’ passports, and glaring word anomalies in electronic bills submitted as proof of residence during the onboarding process.<\/p>\n

\u00abDespite the likelihood of passports and resident identity cards being fraudulent, there’s still the possibility that these documents contained legitimate information or pictures from others who have had their identity information stolen or borrowed,\u00bb Huntress added.<\/p>\n

A second case this month at an unnamed financial services firm uncovered the presence of PiKVM on their device. The use of KVM switches like PiKVM or TinyPilot has been previously attributed to the North Korean IT worker scheme, allowing the remote threat actors to connect to devices hosted on laptop farms.<\/p>\n

The \u00abemployee\u00bb is also said to have accessed a third-party file-sharing service SendGB to download a modified version of a legitimate GitHub profile, likely for use as their own profile picture on an internal communications tool. <\/p>\n

Days after the installation of PiKVM, the same device also had a Guermok USB<\/a> capture card attached to it so as to enable \u00abvideo streaming through it to be sent as a webcam input in web conferencing applications such as Zoom.\u00bb Although the use of Guermok by itself isn’t suspicious, the fact that PiKVM installation and Guermok USB attachment happened one after the other raises red flags.<\/p>\n

In a third case investigated by Huntress in August 2026, a sales and marketing hire onboarded 13 days earlier appeared to have stolen or borrowed an existing identity to land the job, substituting the legitimate individual’s face with the suspected DPRK worker after the former’s details, including name, date of birth, and location, along with their mugshot were posted online by law enforcement post their arrest.<\/p>\n

\u00abMitigating the risk of fraudulent workers begins at the interview stage and continues with performing rigorous background checks of new hires prior to onboarding,\u00bb Huntress said. \u00abWhen in doubt, performing standard background checks, searching the individuals online, and verifying any employment history will help to weed out DPRK workers early in the interview process.\u00bb<\/p>\n

These are far from isolated cases. Recorded Future’s Insikt Group said it observed one cluster linked to PurpleDelta applied to jobs at over 1,100 companies, mostly in software and technology, staffing and consulting, and healthcare and biotechnology sectors, between late 2024 and early 2025.<\/p>\n

The threat actors, comprising multiple operators likely based in China, are suspected to have maintained 22 fabricated personas, some synthetically generated using artificial intelligence (AI) and using identity documents sourced from an illicit ID-generation service called TrustID Card (\u00abtrustidcard[.]com\u00bb).<\/p>\n

Describing PurpleDelta as maintaining a \u00abhigh operational tempo,\u00bb the threat intelligence company said the threat actors have applied to at least 60 positions per day across 10 job platforms, used multi-account management browsers and separate Google Chrome profiles to manage distinct personas, and maintained extensive tracking spreadsheets to coordinate applications across identities.<\/p>\n

\u00abDuring job interviews, they used screen recording software alongside AI transcription and chatbot tools to generate real-time answers, often repeating ChatGPT responses verbatim,\u00bb Recorded Future added<\/a>. \u00abOnce employed, operators recorded internal meetings at victim organizations and used Google Translate to draft pre-written excuses to justify using personal devices and bank accounts for work.\u00bb<\/p>\n

In addition, PurpleDelta operators have been found to rely on identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, as well as coordinate via Telegram and Slack to complete work, and communicate with facilitators who procure and maintain company-issued hardware on the operators’ behalf.<\/p>\n

\u00abPurpleDelta activity is almost certainly ongoing and will very likely continue to expand in scale and sophistication as North Korean IT workers adapt to increased awareness and detection efforts,\u00bb Recorded Future explained.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe increasing integration of AI tools<\/a> into PurpleDelta’s tradecraft presents a compounding risk. The use of custom ChatGPT assistants, real-time AI transcription during interviews, and AI-generated profile photos lowers the barrier to plausible deception and enables operators to perform credibly in technical roles they may not fully understand.\u00bb<\/p>\n

The findings coincide with a number of related developments –<\/p>\n