DPRK Fake IT Workers Fraud Playbook

This report documents a DPRK-associated fake IT worker cybercrime ecosystem that recruits remote developers and pays local ‘supporters’ for identities, uses PSD identity templates and data brokers to bypass verifications, leverages stealer logs for access and maintenance of hosting/CDN infrastructure (including Funnull and a custom CDN/WAF), and performs cryptocurrency cash-outs via Tron/USDT; it includes role definitions, targeted U.S. locations, assessed operator profiles, and TRON-related resources.