Shares tags: ITWorker, PiKVM • Same author: Hayden Mckenzie • Published within a week
North Korea's Desperate Methods of Recruitment
2026-08-19 • Hayden Mckenzie •
https://haydenmckenzie.com/research/eleven-stages-five-observed-live
Attachments
source_4032.pdf (353 KB)
North Korean IT-worker operators openly solicited U.S.-based laptop hosting, aged LinkedIn accounts, stolen identities, and bulk job applications in public Discord channels. Observed offers included $500 per month to host an employer laptop in Texas, a hand-drawn KVM deployment diagram, and six identity packages supplied on request. The activity exposes several stages of the fraud pipeline, from victim selection and persona building to recruitment of facilitators and hardware onboarding.
Related Reports
Shares tags: ITWorker, PiKVM • Published within a week
2026-08-10 •
60% Match
#ITWorker
#FamousChollima
#NickelTapestry
#Deepfake
#JasperSleet
#PiKVM
#TinyPilot
Shares tags: ITWorker, PiKVM • Published within a month
Shares tags: ITWorker, PiKVM
2026-09-23 •
40% Match
#ITWorker
Shares tag: ITWorker • Same author: Hayden Mckenzie
2026-09-18 •
40% Match
North Korean "WaterPlum," commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe
JPNPA
Shares tag: ITWorker • Published within a month