North Korean Hackers Use Fake IT Worker Scheme to Infiltrate Companies and Evade Sanctions

North Korean state-sponsored operatives have run a multi-continent fraud campaign posing as remote IT workers since at least 2017 to funnel salaries back to the regime and, increasingly since late 2024, to steal sensitive data and extort employers; investigators identified key IOCs (luckyguys.site -> 163.245.219.19, 216.158.225.144), heavy use of VPN providers (Astrill, Mullvad, Proton), and residential IP/laptop-farm deception techniques.