source_4034.pdf (869 KB)

An OSINT investigation connected previously identified DPRK-affiliated GitHub accounts to Discord channels where DPRK IT workers outsourced fraudulent job applications to gig workers. Bidders earned $0.05–$0.10 per application and $1–$3 for interviews, with payments made in USDT over BEP20, while targeting remote software engineering, DevOps, and cloud roles. Gmail forwarding separated high-volume application submission from interviews conducted by the DPRK-controlled persona, and structured spreadsheets tracked each bidder's work. Some bidders used ChatGPT and ResumeKit to tailor resumes and improve interview yield.