Ddos 
A recent report by Okta Threat Intelligence has shed light on the alarming ways that North Korean operatives are leveraging generative artificial intelligence (GenAI) to infiltrate international IT companies. These schemes, often referred to as “DPRK IT Workers” or “Wagemole” campaigns, are using AI to create convincing online personas, generate persuasive resumes, and even pass interviews with the aid of deepfakes.
The investigation uncovered that GenAI is used at every step of the employment pipeline—creating lifelike digital personas, generating convincing CVs, and even conducting mock interviews powered by deepfake technology. These AI-generated personas are managed by facilitators who operate from so-called “laptop farms” in countries like the United States.
“Facilitators are now using GenAI-based tools to optimize every step in the process of applying and interviewing for roles… and to aid DPRK nationals attempting to maintain this employment.”
The report highlights that once employed, these AI-assisted operatives often work multiple jobs simultaneously, funneling funds back to the heavily sanctioned North Korean regime.
Okta’s research identified a suite of AI-enhanced tools used by DPRK facilitators:
- Unified Messaging Systems: Used to control communications across multiple personas and accounts from a single interface.
- Resume Optimization Tools: Services that test and iterate CVs against applicant tracking systems to increase success rates.
- AI-Driven Mock Interviews: Platforms that coach candidates on facial expressions, lighting, and scripted responses—sometimes using deepfake overlays to bypass video screening.
- Recruiter Platforms Misused: Facilitators deploy fake job listings to collect real applicant data, training their AI to better impersonate legitimate candidates.
- LLM-Based Chatbots & Code Training: Used to provide just enough technical and linguistic fluency for candidates to survive early employment stages.
“Facilitators were observed using AI-enhanced services that deploy GenAI agents to host and record first-round interviews on behalf of employers, then critique and offer improvement tips for the interviewee,” the report warns.
The scale of the operation is huge. In one case, an Arizona-based facilitator helped over 300 individuals gain employment across the U.S., while another laptop farm in North Carolina was linked to 64 companies.
“The scale of observed operations suggests that even short-term employment for a few weeks or months at a time can, when scaled with automation and GenAI, present a viable economic opportunity for the DPRK.”
Some infiltrators went beyond financial motivations—U.S. authorities have identified instances where access to internal systems was used for espionage or data extortion.
To mitigate these threats, Okta Threat Intelligence recommends:
- Embedding identity verification into onboarding processes
- Training staff to detect signs of fraudulent applicants
- Monitoring for unauthorized use of remote management tools
Okta has also rolled out enhanced identity verification features within Okta Workforce Identity to help customers counter these emerging threats.
Related Posts:
- North Korean IT Workers Pose as Developers on GitHub to Infiltrate Global Companies
- Millions Stolen: North Korea Hackers Target Blockchain Industry
- $5 Million Reward Offered After Indictment of North Korean Cyber Operatives
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
