North Korean IT Workers: Laptop Farms and Fake Interviews

On 18 September 2026, seven agencies from Japan, the United States, Australia and Germany put two North Korean operations into one document. North Korean IT workers pose as job candidates to get hired by your company. A group the agencies call WaterPlum, better known as Contagious Interview, poses as recruiters to infect your developers. According to the advisory, the two share IP addresses and in some cases the same people, and Japan's NPA and the FBI assess that WaterPlum and some of the IT workers answer to the same part of the regime.

The recruiter side alone infected at least 30,000 devices in more than 100 countries between around December 2025 and July 2026, and moved 1.7 billion yen (about US$10.71 million) in cryptocurrency, according to the joint advisory. The same document reports Japan's first laptop farm takedown.

This is a working analyst's read for three people: the CTI analyst who briefs it, the recruiter who screens candidates, and the hiring manager who ships the laptop.

What Is the North Korean IT Worker Scheme?

The North Korean IT worker scheme is a revenue operation in which North Korean nationals obtain remote software, web and IT jobs under false, stolen or borrowed identities, usually with help from facilitators abroad, and send the pay back to the regime. The US government's May 2022 guidance says the DPRK "has dispatched thousands of highly skilled IT workers around the world," earning revenue that contributes to its weapons programs. Salary is the main goal, not the only one: the FBI warned in January 2025 that workers discovered on company networks had extorted victims by holding stolen data and code hostage.

A laptop farm is the trick that makes it work. The advisory defines it as "a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers." The employer ships a laptop to what it believes is the new hire's home, a facilitator plugs it in, and the worker operates it from another country, so every login looks domestic.

Contagious Interview runs the same pipeline in reverse. North Korean operators pose as recruiters, invite developers to online interviews or coding tests, and get them to run malicious code that steals crypto wallets, passwords and identity documents. Put the two side by side and the lesson is uncomfortable: hiring is an attack surface in both directions.

Figure 1: The same four hiring stages, abused from both ends. On the left the employer is deceived and pays; on the right the job seeker is deceived and infected. The dashed box is what the advisory says connects them: stated observations plus one assessment, not proof of a single operator. Diagram: CTI Academy.

For a CTI team, this is intelligence that has to reach people who never read threat reports: recruiters, payroll, IT asset management. If you are building that function, start with our guide to what cyber threat intelligence is and who it serves.

What the September 2026 Joint Advisory Says

The advisory was issued by Japan's National Police Agency (NPA) and National Cybersecurity Office, the FBI, the US Department of Defense Cyber Crime Center (DC3), the Australian Signals Directorate's Australian Cyber Security Centre, and Germany's BND and BfV. The English text is published on IC3 as CSA 260918. The NPA's Japanese announcement calls it a public attribution and links a Japanese-language version with a few details the English one leaves out.

Figure 2: The advisory's first page. The title covers two subjects, WaterPlum "targeting IT professionals" and the activities of North Korean IT workers, and the seven agencies are listed before any finding. Source: IC3, joint advisory CSA 260918, captured 2026-09-28.

The headline findings, in the advisory's own terms:

• Period: "From around December 2025 through July 2026"
• Infections: At least 30,000 PCs in over 100 countries
• Targets: Web designers, engineers, crypto, blockchain and Web3 specialists
• Wallets: Funds or account credentials taken from over 7,000 crypto wallets
• Money: At least 1.7 billion JPY (10.71 million USD) in cryptocurrency
• Malware: npm packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle
• Japan: First laptop farm "operated by an enabler in Japan" dismantled
• Chain of command: NPA and FBI "assess" WaterPlum and "some North Korean IT workers" operate under the 313 General Bureau of the Munitions Industry Department

The link. In the English version, section 5 is one sentence: "WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at the Japanese cryptocurrency exchange." Read "cloud-sourcing" as crowdsourcing: the Japanese text uses the ordinary word for crowdsourcing (freelance job) services, as the English does elsewhere in the document. The advisory also states that "some WaterPlum actors also operate as North Korean IT workers." The Japanese-language version names the exchange as bitFlyer, which spotted the applicant and did not hire him; both versions thank bitFlyer in their acknowledgements.

The exchange application. In May 2025 a suspected IT worker applied for an engineering job through the exchange's recruitment form, reaching it over a VPN. The resume claimed more than ten skills in each of programming languages, blockchain and cloud, a European degree, then rapid moves between cities. On video he said he was born in Malaysia and lived in Finland, but "could not speak to most of the claimed skills." The company did not hire him, and the advisory says no damage occurred. The Japanese version adds that he used a Gmail address and connected through NETNUT Proxy, Astrill VPN and High Speed Rabbit Proxy.

AI face swap in interviews. In the English text, WaterPlum actors "conducted online interviews using AI face-swapping software. After a few minutes the actors disabled their video and advised the target to disable their video due to network issues." They took North Korean holidays off for games and soccer videos, practiced Japanese pronunciation with text-to-speech, and "consistently used free machine-translation and AI service plans." Candidates do it too: the FBI's January 2025 notice says IT workers "have been observed using artificial intelligence and face-swapping technology during video job interviews."

Damage beyond salary. In the English text, one North Korean IT worker "extorted a company over payment and published its proprietary source code online"; another, hired for website maintenance, defaced the hiring company's site. The Japanese version is softer on the second case: it says only that a website a North Korean IT worker helped build was later defaced, without saying who did it.

Figure 3: The passages behind two headlines, from the English version. The first bullet is the face-swap behavior; section 5 is the English text's entire stated evidence for the IP link. Notice what is missing: the addresses themselves, and how many other users shared them. Source: IC3, joint advisory CSA 260918, page 8, captured 2026-09-28.

Advisory versus coverage. SecurityWeek's write-up gets the numbers right but says operators "frequently" used face swapping and that Japan dismantled the farm "this year." The advisory gives no frequency and no takedown date. The language versions differ too: where the English says the actors "advised the target" to switch off video, the Japanese says members advised one another to use the face swap for only a few minutes and then turn their video off, blaming the network, and it gives Magicam as an example of the software. And the dollar figure is a conversion at 159 yen per dollar; the Japanese text describes the 1.7 billion yen as crypto sent to WaterPlum-controlled wallets, where the English summary says it was transferred to the DPRK.

How a Laptop Farm Works

A laptop farm solves one problem: the employer expects a domestic employee, and the worker is abroad, "usually located in North Korea, China, or Russia, with a small number residing in Africa and Southeast Asia," per the advisory. Everything in the setup exists to hide that.

Figure 4: A laptop farm and its money path, simplified. The employer only sees the blue side: a laptop at a domestic address logging in from a local IP, and a payroll record in the name on file. The remote-access and account-holder legs are where these schemes get caught. Diagram: CTI Academy.

• Identity. Workers "use ID images supplied by domestic enablers for impersonation," says the advisory; the July 2026 multinational alert adds proxies "residing in third countries."
• Hardware. In one US case the Justice Department says facilitators "received and/or hosted laptops belonging to U.S. companies at their residences" and connected them to KVM (keyboard-video-mouse) switches. Microsoft's Jasper Sleet research adds IP-based KVM devices such as PiKVM and TinyPilot, and tools including Rust Desk, TeamViewer and AnyDesk.
• Network cover. Microsoft says the workers "typically use VPNs (particularly Astrill VPN)," one of the services the Japanese-language advisory lists for the exchange applicant.
• Money. Workers "use enabler bank accounts to receive payments, with the enablers then transferring funds to the actors." The July 2026 alert says the account holder keeps "a part of the payment" as a fee.

That account-lending pattern is the recruit-a-local-account-holder logic of the money mule ecosystem, pointed at payroll.

On 30 June 2025 the Justice Department announced "searches of 29 known or suspected 'laptop farms' across 16 states," plus seized financial accounts and websites, in schemes that had placed workers at more than 100 US companies.

Figure 5: The Justice Department's June 2025 announcement. Read the subtitle: 16 states, 29 financial accounts, 21 websites and approximately 200 computers, the physical and financial chokepoints of the scheme. Source: US Department of Justice, Office of Public Affairs, captured 2026-09-28.

The best-documented farm belonged to Christina Chapman of Arizona, sentenced to 102 months in July 2025. The Justice Department says her scheme used 68 stolen identities, defrauded 309 US businesses and two international ones, and generated more than $17 million. More than 90 laptops were seized from her home, where she kept notes identifying the company and identity tied to each one, and she shipped 49 laptops and other devices overseas, including to a Chinese city on the North Korean border. In May 2026 two more facilitators were sentenced to 18 months each for schemes that generated more than $1.2 million and hit nearly 70 US companies.

Japan's case is thin on public detail: an enabler in Japan, no place, date or name. Alongside it, the advisory says evidence from Japanese investigations "suggests North Korean IT workers transferred several hundred million Japanese yen abroad, including cryptocurrency assets"; the Japanese text says that total includes amounts found in related investigations. The advisory's advice to householders is blunt: "Do not provide remote-operatable PCs in your home to third parties indiscriminately."

Inside Contagious Interview: The Fake Job Interview Malware Chain

Palo Alto Networks Unit 42 named the campaign in November 2023 "because the threat actor attempts to infect software developers with malware through a fictitious job interview." The same report described Wagemole, a fraudulent job-seeking campaign. The pairing was there from day one.

The September 2026 advisory describes the chain as it looks now:

1. Approach through "social media platforms, online job platforms, gig work platforms, or freelance marketplaces," often impersonating AI, crypto or NFT companies.
2. Pretext: a technical interview, a coding assignment, or a request to "troubleshoot an error in the online video conferencing platform."
3. Execution: the target runs files hosted on code repositories, including npm packages carrying BeaverTail (JavaScript), InvisibleFerret (a Python backdoor) or OtterCookie (a JavaScript RAT and stealer).
4. The editor trick: StoatWaffle ships blockchain-themed repositories with "a malicious VS Code configuration file that triggers auto-run code execution when the folder is opened and trusted by the victim."
5. Collection: saved browser credentials, clipboard, keystrokes, screenshots, wallet keys and seed phrases, and "ID pictures of driver's licenses, passports, etc."

The payoff does not stop at the wallet. Infections give WaterPlum "opportunities to infiltrate organizations employing targeted developers," and stolen ID images "can also be used by North Korean IT workers to impersonate victims." That is where the two directions meet: an infected job seeker's passport scan can become the next fake candidate. The first stage is functionally an infostealer, so our infostealer and stealer log guide applies to what happens next.

A caution for analysts: a fake recruiter is a lure, not a signature. On the same day as the advisory, SentinelLABS published an intrusion at an India-based IT provider "unaffiliated with cryptocurrency," attributed to TraderTraitor (aka UNC4899, Jade Sleet), in campaigns using "fake job interview lures, a traditional Contagious Interview approach common among DPRK actors." TraderTraitor is one of the heist clusters weighed in our Bitget hack analysis. Same lure, different cluster, different detections.

Four Years of Warnings: A Timeline of Government Action

The warnings started in 2022. US charges against laptop farm operators followed in May 2024, and the coordinated nationwide actions came in 2025.

Figure 6: Selected public actions on a proportional monthly axis. Guidance came first, US laptop farm prosecutions began in 2024 and accelerated through 2025, and Japan moved from alerts to its first takedown. Dates are publication dates of the government documents in the Sources list; the exchange is named only in the Japanese-language version of the advisory. Diagram: CTI Academy.

Two reference points belong in every briefing. The 2023 US and South Korea update added red flags that still work, such as a laptop address that is a freight forwarder or "rapidly changes upon hiring." And the July 2026 multinational alert notes that the US, Japan, South Korea, the UK, Australia and Canada have all issued advisories, and that UN Security Council Resolution 2397 requires states to repatriate North Korean nationals earning income in their jurisdiction, subject to limited exceptions. The Justice Department's DPRK RevGen: Domestic Enabler Initiative, launched in March 2024, has announced further actions in January 2025, June 2025, November 2025 and April 2026, according to the department.

WaterPlum, Famous Chollima, Jasper Sleet: Who Calls It What

The core naming disagreement is easy to state: Unit 42, Microsoft, Google, ESET and Recorded Future use separate names for the IT workers and the fake recruiters, and CrowdStrike uses one name for both.

Microsoft says Storm-1877 ran the npm campaign "reported publicly by PaloAlto as Contagious Interview," and later writes "Coral Sleet (formerly Storm-1877)." Microsoft's own split is not clean, though: that same post files Jasper Sleet and Coral Sleet together under "North Korean remote IT worker activity," and the Jasper Sleet post says Storm-1877 also pursues fraudulent employment. Mandiant tracks IT worker operations as UNC5267, and Google tracks UNC5342 in the campaign "dubbed Contagious Interview by Palo Alto Networks." Google's July 2026 renaming does not list either cluster in its table of renamed North Korean groups, a table Google describes as a selection.

CrowdStrike's FAMOUS CHOLLIMA profile says the adversary "primarily conducts operations to illicitly obtain freelance or full-time equivalent (FTE) work" and "has also deployed the custom malware families BeaverTail and InvisibleFerret." Recorded Future makes the opposite choice: "While some organizations track the Contagious Interview cluster and North Korean IT workers as the same set of activity, Insikt Group tracks North Korean IT workers separately as PurpleDelta." And NTT Security Japan writes that WaterPlum is "also called as Famous Chollima or PurpleBravo," so one Japanese name maps to a CrowdStrike name covering both columns and a Recorded Future name covering one.

The government answer sits in between: two names, one bureau, "some" shared people. When you write it up, pick one scheme, cite it, and list aliases as "overlaps with," never "equals." Our explainer on threat actor naming covers why alias tables break exactly like this.

How Analysts Attribute This Kind of Activity

The advisory gives you conclusions and very little of the evidence under them. If you work this activity in your own environment, you build the evidence yourself and price it honestly.

Figure 7: What the advisory offers as the link. Solid grey links are observations it states; amber links are the agencies' assessment. Vendors report a similar overlap in their own research, which corroborates the link without proving a single operator. Diagram: CTI Academy.

Infrastructure overlap. Shared IPs are only as strong as the addresses are rare. A commercial VPN exit carries thousands of unrelated users; a VPS rented by one enabler carries one tenant. Microsoft and the Japanese-language advisory both point to Astrill VPN, so an Astrill exit alone should never close a case. Ask the tenancy question before the attribution question.

Identity reuse. The FBI says the workers "have reused phone numbers (particularly voice-over-IP numbers) and email addresses, on multiple resumes purportedly belonging to different applicants." The July 2026 alert flags several accounts built on one ID document. Cross-checking your own applicant tracking system is often the fastest pivot you have.

Payment trails. Money needs a real account holder, which is why a payee name that does not match the employee, crypto requests, and pay into "an account in another person's name" are all red flags, and why the Justice Department seized 29 financial accounts in 2025.

Persona OSINT. The 2023 guidance flags profiles that do not match the resume and "multiple online profiles for the same identity with different pictures"; Microsoft reports workers using tools like Faceswap to put their photos on stolen documents. Research those personas from managed identities, never your own; our guide to sock puppet accounts covers how.

Behavior. Holidays off, pronunciation practice, free AI plans, Korean language preferences: supporting evidence that narrows the field without closing it. An interview is also a human-source encounter, and panelists who notice a second monitor or background voices are doing what our HUMINT in cybersecurity guide describes.

One line stays firm: the goal is a defensible assessment of a cluster and the controls it implies, not naming a private person. Identification is law enforcement's job, and people whose identities were stolen are victims too.

How to Spot North Korean IT Workers: Red Flags for Hiring Teams

Every item below comes from the government sources above: the advisory, the FBI notices, the July 2026 alert and Justice Department case records. The July 2026 alert says to worry when several apply at once. None of it is about nationality or appearance; the signal is a mismatch between what a candidate claims and what you observe.

• Application. Red flag: burst of applicants for a niche role; source IP does not match claimed residence. Control: check application IPs where you can; search your HR system for the same resume, phone or email.
• Resume. Red flag: implausibly wide skills; degree abroad, then rapid moves; typos and odd nomenclature. Control: ask for detail on each listed skill; verify certification numbers.
• Interview. Red flag: avoids camera or meeting in person; frozen video; reads from another screen; background voices. Control: ask personal "soft" questions; have ID held up to the camera; do as much as possible in person.
• Offer. Red flag: wants crypto, or pay into another person's account. Control: pay only a verified account in the employee's name.
• Onboarding. Red flag: laptop address is a freight forwarder or changes right after hiring. Control: ship only to a verified address, signature required.
• Employment. Red flag: remote desktop tools, KVM devices, logins from several countries, code copied to personal repos. Control: block unapproved remote access, least privilege, geolocate laptops, watch repository exfiltration.
• Suppliers. Risk: workers placed through staffing firms and subcontractors, whom you never screened yourself. Control: ask for their background-check documentation; add subcontracting clauses.

Two legal points belong in front of HR. The advisory warns that paying North Korean IT workers "may constitute violations of domestic laws and sanctions against DPRK," and the FBI said in May 2026 that "hosting laptops for DPRK IT workers is a federal crime." If you suspect a current worker or contractor, the advisory says to contact the police and "promptly revoke accounts and sessions"; in the US, the FBI asks for reports to IC3.

Red Flags for Job Seekers and Developers

If you are the one being recruited, these defenses come straight from the advisory:

• Never run a stranger's code on a machine that holds wallets or personal data. Use a sandbox or virtual machine, and look for obfuscated sections first.
• Treat "fix your camera" instructions as hostile, especially commands containing strings like "curl," "base64," "-enc" or "mshta."
• Open unknown VS Code projects in Restricted Mode. Answer "No" to the trust prompt, read .vscode/tasks.json, and never open an interview project inside a folder you already trust.
• If you ran it, assume the wallet is gone. Disconnect, create a new wallet on a separate device, move the assets, keep the seed offline, and reinstall the operating system.

If you ran interview code on a work laptop, tell your security team the same day: the advisory warns that infections give WaterPlum a way into the victim's employer.

What CTI Teams Should Do With This Advisory

Priority intelligence requirements, each with an owner: Are any remote employees or contractors working for the DPRK, directly or through a staffing firm? Are our developers being approached by fake recruiters, and where? Which hiring, payroll and device-shipping steps would let a laptop farm through today?

Hunts built on sourced behaviors: unapproved remote access tools and IP-based KVM devices, commercial VPN logins on corporate laptops, one identity logging in from several countries in a short window, software that runs multiple concurrent video calls (an FBI indicator), and bulk copying of repositories to personal accounts. Our own addition, derived from the malware descriptions rather than a published rule: watch developer machines where a freshly cloned project spawns Node.js or Python processes that call out to hosts other than your package registries. MITRE ATT&CK tracks the fake-recruiter cluster as G1052.

A shared process with HR. Most of these detections start in a recruiter's inbox, not a SIEM. Give recruiters one channel to flag a candidate, and share outward: indicators to your ISAC under the right Traffic Light Protocol label, reports to IC3 or national police.

Caveats: What the Evidence Does and Does Not Support

• Conclusions, not evidence. The 313 General Bureau link is an NPA and FBI assessment, and the shared-IP finding comes without addresses or tenancy. That does not make it wrong; it means you cannot weigh it yourself.
• Confidence varies. Unit 42 attributed Wagemole to North Korea with high confidence and Contagious Interview with moderate confidence in 2023.
• Floors and conversions. "At least 30,000" is a minimum, and the Japanese text hedges the count as PCs "believed" to number more than 30,000. The US$10.71 million is a yen conversion. The "several hundred million yen" measures something else, money North Korean IT workers sent abroad, and the advisory does not say whether it overlaps with the 1.7 billion yen WaterPlum figure, so do not add the two together.
• Scale estimates do not combine. The May 2022 US advisory says individual workers can earn "more than USD 300,000 a year in some cases" (a 2025 Justice Department release restates it as "up to $300,000"), and the Justice Department cites "hundreds of millions of dollars collectively each year"; the cases here run from more than $1.2 million (two schemes combined) to more than $17 million.
• Names overlap; they are not equal. And the two language versions of the advisory differ, so quote the one you read.

Building the Judgment Behind an Attribution

Anyone can forward "North Korea did it." The analyst's work starts after that sentence: which observations are rare enough to carry weight, which are shared by thousands of VPN users, and how to write a confidence line a hiring manager can act on without overreacting.

That is what the Threat Actor Profiling & Attribution learning path at CTI Academy is built around. The page describes four sections, 38 lessons, 190 quizzes and seven hands-on missions on live investigation surfaces, organized around an evidence ladder that grades each observation as weak, supporting, strong or exceptional by how many operators could have produced it. Its technical correlation section makes this advisory's point exactly: a shared IP means nothing until you know how many tenants share it.

Figure 8: The path page as it appears on the site. The description spells out the approach: grade evidence, weigh competing hypotheses, and say so when the evidence will not carry a name. Source: CTI Academy, Threat Actor Profiling & Attribution learning path page (linked above), captured 2026-09-28.

Frequently Asked Questions

What is the North Korean IT worker scheme?

It is a revenue operation in which North Korean nationals get remote IT and software jobs under false, stolen or borrowed identities, often helped by facilitators abroad, and send the salaries back to the regime. US guidance says the DPRK has dispatched thousands of such workers. Some have also stolen data or extorted their employers after being discovered.

What is a laptop farm?

A laptop farm is a location, often a facilitator's home, where laptops issued by employers are set up and remotely controlled by North Korean IT workers abroad. It makes the worker's logins appear to come from a domestic address. US authorities searched 29 known or suspected laptop farms across 16 states in June 2025, and Japan dismantled its first one, disclosed in the September 2026 joint advisory.

What is Contagious Interview?

Contagious Interview is a North Korean campaign in which operators pose as recruiters and get software developers to run malicious code during a fake interview or coding test. The September 2026 joint advisory calls the group WaterPlum and says it infected at least 30,000 devices in more than 100 countries and took funds or credentials from over 7,000 crypto wallets.

Is WaterPlum the same as Famous Chollima?

Partly. WaterPlum is the name the joint advisory and NTT Security Japan use for the Contagious Interview group, and NTT says it is also called Famous Chollima or PurpleBravo. CrowdStrike's Famous Chollima, however, covers both the fake recruiters and the IT worker scheme, while Recorded Future and ESET track the two separately. Treat these names as overlapping, not identical.

How can recruiters spot a North Korean IT worker?

Look for combinations of red flags rather than one: an application IP that does not match the claimed residence, a resume with an implausibly wide skill set, reluctance to appear on camera or meet in person, frozen video, reading from another screen, and requests to be paid in crypto or into someone else's account. Verify identity on camera and in person where possible, and ship laptops only to verified addresses.

What should I do if a recruiter asks me to run code during an interview?

Do not run it on a machine that holds crypto wallets, passwords or personal documents. If you must look at it, use a virtual machine, open VS Code projects in Restricted Mode and read the task configuration first. If you already ran it, disconnect the device, move your crypto to a new wallet created on a separate device, and reinstall the operating system.

Can you get in trouble for hosting laptops for a remote worker?

Yes. The FBI has stated that hosting laptops for DPRK IT workers is a federal crime in the US, and in the cases covered here US facilitators received prison sentences of 18 to 102 months. The joint advisory warns that, depending on the circumstances, knowingly providing payment or ID images to North Korean actors could constitute a crime. Never host a company laptop for someone you have not verified, whatever the offer.

How much money do North Korean IT workers make for the regime?

There is no single reliable total. US guidance says individual workers can earn more than $300,000 a year in some cases, and the Justice Department says the workers collectively generate hundreds of millions of dollars a year. Documented US cases range from more than $1.2 million to more than $17 million, and Japanese investigations found several hundred million yen sent abroad by North Korean IT workers.

Sources

The September 2026 joint advisory - IC3: Joint advisory CSA 260918 on WaterPlum and North Korean IT workers (English, PDF) - NPA: Announcement of the public attribution, 18 Sep 2026 (Japanese) - NPA: Japanese-language version of the advisory (PDF) - SecurityWeek: Japan dismantles first North Korean laptop farm

Government guidance and enforcement - US Treasury (OFAC): Fact sheet, guidance on DPRK IT workers, 16 May 2022 (PDF) - US State, Treasury and FBI: Guidance on DPRK IT workers, full advisory, 16 May 2022 (PDF) - FBI IC3: Additional guidance on DPRK IT workers, 18 Oct 2023 - FBI IC3: North Korean IT workers conducting data extortion, 23 Jan 2025 - BfV: Private Sector Security Advisory 02/24, North Korean IT workers, 1 Oct 2024 - NPA: Alert index on North Korean IT workers (Japanese) - NPA: Multinational alert on North Korean IT workers, 31 Jul 2026 (PDF) - Japan, US, South Korea: Joint statement on North Korean IT workers, 27 Aug 2025 (PDF) - DOJ: Arrest, premises search and domain seizures under the DPRK RevGen initiative, 16 May 2024 - DOJ: Coordinated nationwide actions against North Korean IT worker schemes, 30 Jun 2025 - DOJ: Arizona woman sentenced for $17M IT worker fraud scheme, 24 Jul 2025 - DOJ: Two North Korean nationals and three facilitators indicted, 23 Jan 2025 - DOJ: Two US nationals sentenced for facilitating IT worker schemes, 6 May 2026

Vendor research and naming - Unit 42: Two campaigns by North Korean actors target job hunters (Contagious Interview, Wagemole), Nov 2023 - Microsoft: Jasper Sleet, North Korean remote IT workers' evolving tactics, Jun 2025 - Microsoft: Moonstone Sleet emerges (Storm-1877 and Contagious Interview), May 2024 - Microsoft: AI as tradecraft (Coral Sleet, formerly Storm-1877), Mar 2026 - Microsoft: Contagious Interview, malware delivered through fake developer job interviews, Mar 2026 - Mandiant: Mitigating the DPRK IT worker threat (UNC5267) - Google Threat Intelligence Group: DPRK adopts EtherHiding (UNC5342) - Google Threat Intelligence Group: Updated cyber threat actor naming system, Jul 2026 - CrowdStrike: FAMOUS CHOLLIMA adversary profile - ESET: DeceptiveDevelopment targets freelance developers, Feb 2025 - ESET: DeceptiveDevelopment, from primitive crypto theft to AI-based deception (WageMole), Sep 2025 - Recorded Future: PurpleBravo's targeting of the IT software supply chain - Recorded Future: PurpleDelta's fraudulent employment operations - NTT Security Japan: OtterCandy, malware used by WaterPlum - Trend Micro: Void Dokkaebi uses fake job interview lure, Apr 2026 - MITRE ATT&CK: Contagious Interview, G1052 - SentinelLABS: TraderTraitor backdoors resurface on victim with no crypto ties, 18 Sep 2026