Five remote hires turned out to be probable North Korean workers

During 2026 Huntress supported investigations in which five people were assessed as likely North Korean workers inside partner organisations. The roles covered IT, sales and marketing, and healthcare. For three of them Huntress obtained and reviewed identity documents that appear to be fraudulent. A fourth had a photograph lifted from a genuine GitHub account, with the face altered. Huntress stresses that single indicators rarely settle anything on their own, and recommends correlating identity, authentication, device, browser and behavioural evidence.

What Huntress describes is convergence rather than any single finding. In one Australian case three accounts repeatedly authenticated through Astrill VPN, and also used the IPRoyal proxy service. Less than half of the observed activity fell inside normal business hours, and the peak landed exactly at midnight UTC, which is nine in the morning in North Korea. Identity documents in two of the accounts showed passports issued in the same city one day apart, identity cards valid for exactly the same period from the same police station, and image files taken with the same camera model. A fifth case surfaced through a hunt for hosts with network-attached KVM hardware, where Huntress found browser extensions for translation and pronunciation, and software that pipes a screen capture back in as though it were a camera.

What this means for you if you hire people you never meet

This is not a hole in your technology. It is a weakness in hiring, and it sits outside what your security tooling looks for. Our assessment is that the control has to live where identity is first established, meaning recruitment, rather than in the logs afterwards. Huntress itself points to stronger screening and identity verification at hiring as the key defence.

If you employ remote staff, none of the trails above holds up alone. A VPN is not evidence, and neither is work outside office hours. Convergence is what carries weight. We would add that the list of roles is the uncomfortable part of this report. While this was a developer problem, the control could sit with IT. It now covers everyone you hire without meeting them.

Berigo recommends

• Verify identity documents against the issuer, not just against the eye. Images of passports and ID cards are easy to produce.
• Look for patterns across candidates. Two applicants with paperwork from the same place, the same week and the same camera model is no coincidence.
• Hold at least one video call where the candidate does something unrehearsed, and watch for tools that feed a screen capture in as a camera.
• Track when remote staff actually work, and which networks they come from. Anomalies are not proof, but they are somewhere to start.
• Do not let a finding stop at one person. Huntress uncovered the fifth case by hunting for the same hardware elsewhere.