logo

Pyongyang on the payroll? Signs that your company has hired a North Korean IT worker

ID: 681c2c60-3b4b-5167-894f-8b87fee5cd4a

STIX ID: report--681c2c60-3b4b-5167-894f-8b87fee5cd4a

Feed Name: CyberScoop

Threat Score
85/100

Date Published: 2024-10-16

Date Updated: 2026-04-21

Author: djohnson

...
...

Secureworks reports a coordinated North Korean operation called "Nickel Tapestry" that embeds fake IT workers at Western firms (U.S., U.K., Australia) to collect salaries and sometimes steal or ransom proprietary data; operatives use personal devices, VDI, laptop farms, video-cloning, frequent payment-account changes, and fake employee networks to avoid detection and funnel funds to North Korea’s weapons programs.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.