Kudelski Security identified four interconnected private networks that it assesses with moderate confidence as development infrastructure supporting DPRK fake IT worker operations. The environment contains AI, NPM, DevOps, CI/CD, source-control, collaboration, and offensive-security services, including Verdaccio, Gitea, Drone CI, Bitbucket, Bamboo, ELK, Gradio, and MobSF. Public VPN and VPS exit nodes overlapped with other North Korean campaigns, suggesting shared infrastructure between fraudulent workers and offensive operators. The observed pursuit of OT, energy, aeronautics, and defense roles indicates that fraudulent employment could provide initial access for espionage or disruptive operations.