DPRK IT Workers Impersonating Individuals Using Real LinkedIn Accounts to Apply for Remote Roles

North Korean operatives have shifted from synthetic identities to hijacking real LinkedIn profiles to secure remote IT roles in Western tech firms, using verified documentation and control of applicant communications to bypass screening; the activity aims to funnel salaries to the DPRK and to gain privileged access for espionage or malware, and defenders are urged to validate account control (e.g., via connection requests or direct platform messages) and monitor for impersonation.