From One Suspicious Applicant to a Global Story: What a Year of Investigating DPRK Employment Fraud Taught Us

A little more than a year ago, we encountered something at Nisos that, given the work we do, surprised us, but we were trained to recognize.

A job candidate applied for a remote role. The resume looked impressive. The experience seemed to line up almost perfectly with the position. But there were inconsistencies that didn’t make sense. The more we looked, the more questions we had.

What happened next turned into one of the most important investigations of my career, and ultimately a year-long effort to understand, document and expose a North Korean employment fraud operation from the inside. What started with one suspicious candidate became a window into an industrial-scale operation targeting companies across the United States.

It also became an opportunity to work with some exceptional journalists and partners to bring a threat that too often lives in the shadows into public view.

How one suspicious resume started the investigation

Nisos has been investigating DPRK IT worker employment fraud for years, so we were familiar with many of the warning signs. In this case, however, we had the opportunity to do something different.

Rather than simply reject the candidate, we decided to investigate. Working with law enforcement, we conducted a controlled operation that allowed us to observe how the suspected operative and the broader network behaved. That decision gave us a remarkable look behind the curtain.

We discovered a U.S.-based laptop farm where company-issued computers could be accessed remotely by workers outside the country. We saw how stolen or purchased identities could be assembled into convincing professional personas. We observed the use of AI-generated resumes and AI assistance during interviews. And we began to understand the network of U.S.-based facilitators who helped make remote employment fraud possible.

One of the most important lessons was that this wasn’t simply a collection of individuals trying to fool a company; it was an organized operation.

Our subsequent research identified a cell with administrators, managers, team leads and operatives. Between December 2024 and September 2025, 22 operatives submitted more than 170,000 job applications and received at least 76 employment offers from U.S. companies. Developers and engineers accounted for more than 70% of the roles pursued, while technology companies represented 42.6% of successful targets.

The operation had processes, performance metrics, communication channels and quality controls. Operatives could manage multiple personas simultaneously. References could be manufactured through closed networks. Documents could be manipulated. U.S.-based “natives” could provide the physical presence that made a remote worker appear to be exactly where they claimed to be. The FBI highlighted some of the ways the US recruits aid and abet just this week.

This was employment fraud operating at scale.

Sharing the investigation with the world

For us, investigating the operation was only part of the responsibility. We also felt strongly that other companies needed to understand what we had learned.

That meant publishing the research ourselves, documenting the tactics and techniques we observed, and sharing what we could with the broader security and intelligence community. Our research showed how the operation worked before employment, during interviews and onboarding, and after an operative was hired.

But research has limits if it doesn’t reach the people who need to see it. That’s where journalism became so important. Over the past year, we’ve had the privilege of working with reporters who took the time to understand not just the headline, but the underlying investigation.

Bringing the story to NBC News

Working with the NBC News team was a particularly meaningful part of this process.

The team didn’t simply want a sound bite about North Korean IT workers. They wanted to understand how the operation actually worked; how identities were constructed, how laptop farms operated, how candidates navigated interviews and how the people behind these personas could potentially gain access to legitimate American companies. That level of reporting truly matters.

The resulting NBC News investigation provided a rare look inside the operation and helped show audiences something that can be difficult to explain in a report: the human machinery behind the fraud. NBC’s reporting brought together our investigative findings, interviews with our team and visual evidence from the investigation to demonstrate how sophisticated and coordinated these schemes have become.

I was particularly impressed by the amount of work the NBC team put into getting the story right. They spent the time to understand the evidence, ask difficult questions and make sure the story conveyed both the scale of the threat and the people involved in uncovering it.

That is what great investigative journalism does. It takes something complicated and largely invisible and makes it understandable.

Following the investigation on To Catch a Thief

Nicole Perlroth’s To Catch a Thief podcast offered another way to tell the story. Rather than simply explaining what DPRK IT worker fraud is, the podcast allowed listeners to follow the investigation and understand the people, decisions and discoveries behind it. For Nisos, being part of that story was an opportunity to explain why this investigation mattered, and why we chose to keep going when we could have simply closed the file on one suspicious applicant and self-publish our findings.

The podcast also helped put the investigation into a much broader context. DPRK employment fraud isn’t just an unusual form of resume fraud. It sits at the intersection of national security, cyber risk, financial sanctions, insider risk and the fundamental question of whether a company knows who it is actually employing.

That is a story worth telling, and Nicole and her team did an exceptional job telling it.

DPRK employment fraud lessons for hiring teams

The DPRK connection is obviously significant. These operations generate revenue for the North Korean regime while potentially giving foreign operatives legitimate access to companies, systems, data and intellectual property.

But after spending a year immersed in this investigation, I believe there is a broader lesson: the fundamental problem is trust.

For decades, our hiring systems have operated on a relatively simple assumption: if a candidate can provide a legitimate-looking identity, resume, references and documentation, we can establish that they are who they say they are. That assumption is becoming harder to defend.

In our investigation, the underlying identity information could be real even when the person presenting it wasn’t. References could be coordinated. Documents could be legitimate-looking or fraudulently obtained. Resumes could be generated or tailored by AI. Interviews could be supported by real-time AI assistance. And a person sitting in front of a camera could be separated from the person actually performing the work.

The questions that need to be asked are not only “Is the person behind these documents real?” but also “Is the information they’re sharing real?” And that problem isn’t going away with the DPRK.

How AI makes convincing candidate profiles easier to create

This is where I think the implications of the past year extend far beyond North Korean employment fraud.

AI is making it easier to create convincing resumes, professional profiles, written work samples, references and other artifacts that have traditionally helped employers evaluate candidates. At the same time, generative AI, voice cloning, synthetic media and increasingly sophisticated interview assistance are making it harder to determine what is authentic and what isn’t.

For already-overwhelmed HR and talent acquisition teams, this creates an enormous challenge.

Recruiters are being asked to move quickly. They are managing hundreds or thousands of applications. They are trying to provide a good candidate experience while dealing with increasingly sophisticated fraud. They cannot reasonably be expected to become investigators, intelligence analysts and deepfake experts at the same time.

That’s why I believe we need to rethink how we establish trust in the hiring process.

We don’t need to treat every candidate as a potential adversary. But we do need to recognize that identity fraud is becoming more sophisticated, more automated and easier to scale. The lesson I take from this year of investigation is simple: we can no longer assume that a convincing digital identity is proof of a real identity. We simply have to get better at understanding the person behind the profile.

I’m proud of the Nisos team for having the curiosity to look beyond the first red flags, the discipline to follow the evidence and the judgment to recognize that what we were seeing needed to be shared. I’m equally grateful to the journalists who helped us bring that story to the world.

Because, ultimately, exposing a threat is only the beginning. The real value comes when what we learn helps other people see it coming.

How the investigation helped shape Identity Integrity

That’s the challenge we’ve been sitting with since this investigation started. If recruiters can’t reasonably be expected to spot a laptop farm or an AI-coached interview, what can we give them instead?

Part of our answer is Identity Integrity, a capability we built directly out of lessons like this one. It doesn’t ask a candidate for anything extra: no selfie, no new document, no added friction in a process that’s already stressful enough. Instead, it cross-references the information a hiring team already has against independent sources, including breach history, public records, and digital footprint, and flags where the story doesn’t hold together.

To be clear about what this is and isn’t: it doesn’t make the hiring decision for you, and it isn’t a replacement for a background check. It gives your team a discrepancy score and the evidence behind it, in minutes, so they know where to look closer and when to escalate to a deeper investigation. The judgment still sits with the people who know the role, the risk tolerance, and the stakes. We just want them making that judgment with better information than a resume and a reference call can offer. It’s a critical part of a new layered defense strategy to keep fraud out of hiring pipelines.

A year ago, this started with one recruiter noticing something that didn’t quite add up. The lesson I keep coming back to is that we shouldn’t have to rely on one person’s instinct catching it. We should be able to build that scrutiny into the process itself, at a scale that matches the scale of the problem.

That’s the real takeaway from this year. Not just that the DPRK threat is real, though it is. It’s that the trust model hiring has run on for decades needs an upgrade, and that upgrade is now within reach.