Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them

**Executive Summary:** Workers aligned with the DPRK infiltrate organizations worldwide through fraudulent remote-work schemes using stolen or synthetic identities, VPNs, remote-access/RMM tools, and U.S.-based facilitators; the report describes their TTPs, supporting infrastructure, a recommended risk matrix, hunting queries (Panorama and Cortex XDR), and operational mitigations to detect and disrupt these activities.