NORTH KOREA INFILTRATION: Thousands Of Operatives Secretly Working Inside U.S. Companies

North Korea has established a hidden network of workers embedded in American companies, use stolen identities, artificial intelligence and domestic facilitators to obtain remote positions and redirect hundreds of millions of dollars to the regime, according to a yearlong Wall Street Journal investigation. The FBI reports that thousands of North Korean operatives are seeking employment across the United States.

The Journal documented one cell's activities through leaked browser histories, emails, calendars and screen recordings from workers' computers, illustrating the extensive role AI plays in the operation. Over roughly three months, the cell submitted applications to more than 1,000 companies, using AI to generate résumés and cover letters and relying on ChatGPT-generated answers during job interviews. As companies improved their detection methods, some workers reportedly deployed AI face-swapping technology to alter their appearance during interviews.

The scheme depends significantly on U.S.-based facilitators. Since company laptops cannot be physically transferred to North Korea, these facilitators maintain the equipment domestically while North Korean workers access them remotely. Facilitators also establish bank accounts, process checks and represent workers in interviews and company meetings. One Ohio man stated he divided salary evenly with North Korean workers on a $75,000 annual position.

The operatives frequently employ stolen American identities to pass employment vetting, at times managing multiple identities and concurrent positions. One Georgia resident whose identity was misused reported suffering consequences including inability to open bank accounts, secure loans or lease property.

The operation's financial scope is substantial. Some North Korean IT workers earn up to $300,000 annually, with the U.S. Treasury Department finding that as much as 90% of salaries reach the regime. Current estimates place yearly revenue from the operation at approximately $800 million. The Journal's investigation traced funds moving through networks of North Korean IT workers and cybercriminals before reaching a U.S.-sanctioned company linked to Pyongyang's weapons development.