Journalists from The Wall Street Journal have released an investigative film Infiltrated: North Korea’s Secret U.S. Workforce about a covert network of North Korean workers in American companies.
The investigation is based on leaked data from a North Korean cell, including browser history, emails, calendars, and screen recordings.
According to WSJ, the FBI has identified thousands of such “applicants” across America. The group tracked by the publication applied to over 1,000 companies in three months, using AI at nearly every stage of the hiring process—from cover letters and resumes to interview preparation and face substitution.
American intermediaries play a key role in the scheme. Corporate laptops remain in the U.S., while North Korean workers connect to them remotely.
Accomplices of the North Koreans open bank accounts, cash checks, and sometimes participate in interviews. A resident of Ohio told the newspaper that he attends work meetings while the actual work is done by North Koreans. The $75,000 annual salary was split equally.
In some cases, stolen American identities are used for background checks during hiring. WSJ claims that workers can manage several “foreign” profiles simultaneously and apply for multiple jobs under each name.
The publication cited an example of a Georgia resident who stated that his information was sold online and used for employment in companies nationwide. He can no longer open a bank account, obtain credit, or rent housing.
Journalists also discovered that part of the salaries goes to the North Korean authorities. According to the U.S. Treasury, some North Korean IT workers earn up to $300,000 a year—about 90% of these funds go to the regime.
Recent estimates suggest the entire scheme could generate up to $800 million annually. The investigation traced the flow of money through a network of North Korean IT workers and cybercriminals to a company sanctioned by the U.S. for Pyongyang’s weapons program.
Earlier, in August, Genians experts found that North Korean hackers had integrated local AI into attacks on crypto companies.
