North Korean IT Infiltrations Surge 220% as GenAI Expands Recruitment Tactics

North Korean IT worker infiltration attempts have surged by 220% over the past 12 months, according to a report by CrowdStrike, as operatives leverage generative AI tools at every stage of the employment process to infiltrate companies globally. The 2025 Threat Hunting report revealed that North Korean workers have infiltrated more than 320 companies in the last year, many of them Fortune 500 firms, by exploiting stolen or fake identities to secure remote IT roles [1]. These workers, trained in elite Pyongyang-based schools, are deployed in teams to locations such as China, Russia, Nigeria, Cambodia, and the United Arab Emirates [1].

The scheme, aimed at circumventing international sanctions, has generated an estimated $250 million to $600 million annually for the North Korean regime since 2018. Operatives are required to earn $10,000 per month, according to a defector, by performing legitimate IT work for U.S. and European companies while maintaining multiple jobs simultaneously [1]. Court records show that North Korean workers have also assisted in cyberattacks that stole nearly $3 billion in cryptocurrency, according to UN estimates [1].

CrowdStrike has observed that North Korean operatives, known as “Famous Chollima,” increasingly use AI to enhance their ability to pass job interviews and perform daily IT tasks. The AI tools help them create synthetic personas, pass video interviews, and navigate technical coding challenges [1]. Once hired, AI chatbots are used to draft emails, respond in Slack, and ensure grammatical accuracy, allowing the workers to maintain multiple positions without detection [1].

A key component of the strategy involves the use of real-time deepfake technology. CrowdStrike investigators noted that operatives search for and pay for subscriptions to deepfake services during active operations, enabling them to appear in video interviews under different identities [1]. The report highlights that a single operator could interview for the same position multiple times using different synthetic personas, increasing the likelihood of being hired [1].

U.S. law enforcement has disrupted domestic laptop-farming operations—where North Korean workers use local infrastructure to access remote jobs—by indicting individuals like Christina Chapman, a 50-year-old Arizona woman. Prosecutors said her operation alone facilitated 309 jobs and generated $17.1 million in salaries for North Korean operatives. Among the companies impacted was Nike, which unwittingly hired a North Korean-linked worker [1].

As the U.S. crackdown intensifies, North Korean operatives have shifted operations to Western Europe, particularly Romania and Poland, where they continue to secure remote IT roles as full-stack developers. The tactics mirror those used in the U.S., with laptops shipped to known farm addresses and excuses such as medical or family emergencies used to justify changes in shipping addresses [1].

Amir Landau of CyberArk emphasized that traditional cyber defenses may no longer be sufficient as generative AI continues to evolve. He advocated for stricter access controls based on the “need-to-know” principle, limiting privileges and granting temporary access to sensitive information. Additionally, he advised companies to verify references independently and scrutinize inconsistent personal details during the hiring process [1].

Despite these measures, both small and large companies remain at risk. As long as North Korean operatives can secure legitimate IT work, CrowdStrike’s Adam Meyers said, they will continue to refine their tactics using AI and adapt to new defenses. “These are basically exploited people from North Korea making money for the regime,” he stated. “As long as they can continue to generate revenue, they’re going to keep doing this.” [1]

Source: [1] North Korean IT worker infiltrations exploded 220% over the past 12 months, with GenAI weaponized at every stage of the hiring process (https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/)