DPRK IT Workers | A Network of Active Front Companies and Their Links to China

SentinelLABS details a DPRK IT Worker scheme in which North Korean actors create and operate front companies and cloned websites (hosted on identified IPs and registered via NameCheap) to impersonate legitimate software firms, secure remote contracts, launder proceeds (including via Chinese entities and cryptocurrency), and support regime activities; the report links specific domains, hosting infrastructure, registrant identities, and corporate records, and notes U.S. law enforcement seizures of four domains.