Nickel Tapestry is the Sophos Counter Threat Unit designation for North Korean fraudulent IT-worker activity conducted to generate revenue for the state. Sophos described the cluster in October 2024 after incident-response investigations found workers using stolen or fabricated identities to obtain remote employment at Western companies. The operation relies on cloned resumes, shared personas, facilitators and laptop farms, residential proxies, VPNs, virtual desktops, and remote-access tools to conceal workers’ locations and maintain corporate access. Workers collect salaries, redirect equipment and payments, and sometimes share jobs or references among coordinated personas. The activity has expanded beyond employment fraud: observed workers exfiltrated proprietary data, stole intellectual property, and demanded cryptocurrency ransoms after termination. Nickel Tapestry has also used remote desktop software and virtual-camera tools to evade technical and video-verification controls, creating both an insider threat and a path to additional financial gain through extortion.