An engineer opens a PDF: a job offer – generous compensation- the end of weeks of process: a LinkedIn approach, multiple rounds of interviews, negotiations. The offer was real enough to sign, but the company did not exist.
The engineer worked at Sky Mavis. The PDF cost the company $625 million, and the recruitment process that delivered it was not the move of a con artist – it was one instance of a programme run by a state.
Photo by Samuel Scalzo on Unsplash
A Decade of Diversification
The programme has a lineage: the 2014 Sony breach established that DPRK cyber operations could be strategic instruments – not nuisance crime – and showed other states the same. What followed was a decade of professionalisation – from spectacle to revenue.
For almost a decade, the DPRK (Democratic People’s Republic of Korea) has run what is best understood as a diversified state revenue programme, built on a single discovery: the hiring, payroll, and vendor controls of Western companies can be passed rather than breached.
In one DOJ court proceeding covering 2021- 2024, more than 100 U.S companies – including Fortune 500 companies – employed remote IT workers operating under stolen identities.
The logistics run through laptop farms: local facilitators take delivery of company-issued laptops, connect them, and install remote-desktop software, allowing workers overseas to appear domestic. Christina Chapman was sentenced to 102 months for running one such operation – a fraudulent scheme that generated more than $17 million for the DPRK.
Employment fraud is the quiet channel. Theft is the loud channel. Chainalysis reported a 51% year-over-year increase in funds stolen by DPRK-linked groups. The 2025 Bybit hack alone took $1.5 billion, bringing the documented all-time total to $6.75 billion. Within the programme, theft and employment serve the same ledger – which is why stolen and revenue are, for Pyongyang, the same word.
The ledger has a purpose. Facing sanctions designed to isolate it economically, the DPRK built an economy the sanctions cannot see: one that runs through the compliance processes of its adversaries’ own companies.
Farming for Salaries
Every company in the DOJ’s indictments had hiring control. Most had background checks, identity verification, and vendor due diligence, with many audited against ISO 27001 or its equivalents.
The question is not why the controls were missing. They weren’t. The question is what each control was allowed to see.
The laptop farm Christina Chapman ran out of a spare room in her home in Arizona was a basic setup – sixty laptops on wire shelving – each one representing a verified employee of an American company.
Each identity passed checks as each identity was real – stolen, but not fabricated. The verification did its job: it confirmed a genuine American existed. It was never asked whether that American was the person at the keyboard.
The signal that could break it – the device location, network origin – belongs to IT, who weren’t involved in the hiring process.
IT’s control is per-hire, but the signal is cross-hire. One remote worker with odd VPN patterns is noise; five hires whose laptops all resolve to the same residential address is a nation-state operation – per-hire control does not aggregate for this view; it requires correlation that nobody owns.
Every fortnight, payroll ran. Salary flowed to an account controlled by the US-based facilitator; the facilitator took a cut and passed the remainder up the chain to a DPRK handler.
Each control sits in a silo; the operation is engineered to never trip two at once. Every control assumes an adversary who avoids the controls, and with a borderless digital landscape expansion is inevitable.
Mandiant reports that expansion beyond the US presents a global threat to industry and has grown in scale and sophistication.
It is estimated DPRK cyber actors and IT workers have stolen over USD 2.8 billion in cryptocurrency since January 2024 and earned an estimated USD 300-800 million in revenue in 2024, enabling the financing of the DPRK’s weapons of mass destruction (WMD) and ballistic missile programs in violation of UN Security Council sanctions.
After the Control Passes
Multiple failure modes, one common property: each invisible from inside its own silo. So who owns the view where the operation is visible?
Let’s step through how we arrived here. HR says identity verification passed – anything after onboarding is security’s. Security monitors the perimeter – this actor came through the front door, credentialed. Compliance says the audit passed, because it did, and nothing flags in legal, each answer required for hiring and onboarding is correct. There has been no negligence, rather the issue lies in a structure where no one is responsible for the aggregate view.
The adversary knows this. The operation is designed to distribute signals and responsibility across functions, ensuring no single team holds enough context to identify the pattern. Adversaries read organisational charts; frameworks don’t.
The same gap exists at larger scales. No framework in your HR pipeline owns ‘nation-state actor insight‘ any more than any individual function does. The one body that held an aggregate, state-level view – The UN Panel of Experts – was disbanded in 2024 by a Russian veto.
Beyond DPRK
In Western media, the DPRK’s evolution into a sophisticated and dangerous criminal actor has often been under-reported, shadowed by the strategic focus on China’s rise. North Korean propaganda is typically portrayed as farcical and its leadership as comical, a framing that obscures the regime’s calculated and highly effective use of asymmetric capabilities.
The DPRK operates a state revenue programme which enters through compliance processes rather than past them. In so many ways, the detected cases understate the scale – the control gap that enabled them is exactly what limits detection. As reported by Recorded Future, expansion beyond the US is underway using the same strategy.
The evidence is harder to document, but the technique generalises. Any adversary that can read an organisational chart can operationalise the same strategy. The DPRK is the documented example, not the limit of the technique.
Several developments are worth monitoring. Regulators are converging on supply-chain risk – DORA and NIS2 in Europe, the SEC’s cyber disclosure rules in the US, and CPS 230 and the SoCI reforms in Australia.
Whether the frameworks produce a correlation owner, or simply multiply siloed obligations, remains unresolved. Australia’s SoCI consultation is the nearest test. A second is whether fake-worker prosecutions outside the US, prompt frameworks to recognise cross-functional and transnational correlation as a control category.
Until then, the controls will keep passing. Passing is what they are designed to do.
Leave a Reply