DPRK IT Workers Expanding in Scope and Scale

This report describes an organized DPRK IT worker ecosystem that operates dozens of fabricated personas to obtain positions in Europe and the U.S., leveraging false references, facilitators (including brokers for passports), and diverse payment methods (cryptocurrency, TransferWise, Payoneer) to conceal operations. The actors have a wide technical portfolio (web, blockchain, AI) and are expanding geographically while increasingly conducting extortion against former employers and exploiting BYOD/virtual environments to avoid detection, indicating a coordinated, adaptable threat to defense, government, and private sector organizations.