source_4033.pdf (4 MB)

A recovered archive tied to a DPRK-affiliated device documents an eleven-stage IT-worker fraud lifecycle: selecting and buying American identities, validating and altering documents, building U.S.-based infrastructure, applying at scale, defeating interviews and onboarding checks, and distributing payroll. The operation used outsourced bidders, aged LinkedIn accounts, U.S. VPS and residential proxy chains, virtual camera and audio-routing tools, PiKVM and remote desktop access, and willing American facilitators. Financial records and contracts show revenue-sharing arrangements, cryptocurrency settlement, and U.S. LLC formation to pursue corp-to-corp roles that avoid standard employment identity controls. The evidence exposes a managed identity supply chain rather than isolated applicant fraud.