The North Korean on your payroll

This report profiles a DPRK-linked actor dubbed “JJ” who has repeatedly applied for roles (notably in AI and healthcare) using fabricated online personas. The actor’s email and account usage patterns—free webmail, recruitment platforms, dynamic DNS, coding and document services—and absence of any personal online footprint are highlighted as distinguishing OSINT indicators; PDF résumé metadata are noted as an additional detection vector.