The team systematically purchased fake social security numbers, Upwork and LinkedIn accounts, phone numbers, and computer rentals to secure developer jobs at various projects.
Google Drive exports and Chrome browser profiles revealed that the workers extensively used Google products to organize team schedules, tasks, and budgets while communicating primarily in English.
Weekly reports from 2025 revealed that team members were struggling with job requirements, with one noting, “I can’t understand job requirement, and don’t know what I need to do,” alongside the directive to “put enough efforts in heart.”
The DPRK workers followed a consistent pattern of purchasing Upwork and LinkedIn accounts, buying or renting computers, then using AnyDesk remote access software to conduct work for their employers.
Expense spreadsheets documented purchases of artificial intelligence subscriptions, VPNs, proxies, and other tools needed to maintain their fake identities.
Meeting schedules and scripts were maintained for each fake identity, including detailed personas like “Henry Zhang” with complete backstories and work histories.
The workers used a wallet address to send and receive payments, to which ZachXBT linked multiple fraudulent operations.
The wallet address tied the team to the $680,000 Favrr exploit from June 2025, where the company’s CTO and other developers were revealed as DPRK IT workers using fraudulent documents.
ZachXBT identified the Favrr CTO “Alex Hong” as having a suspicious background with recently deleted LinkedIn profiles and unverifiable work history.
Browser history from the compromised devices showed frequent Google Translate usage with Korean translations while operating from Russian IP addresses.
The evidence confirmed the workers’ North Korean origins despite their sophisticated English communications and Western personas.
The workers convert earnings from development work into cryptocurrency through Payoneer, with the investigator noting they are “in no way sophisticated but are persistent since there are so many flooding the job market globally for roles.”
The exposure reveals the scale of North Korean infiltration into Western technology companies, with the compromised operation representing just one team among potentially hundreds operating similar schemes across remote development platforms.
