source_4138.pdf (2 MB)

North Korean IT worker teams are moving beyond domestic U.S. laptop farms by transporting employer-issued systems to Pakistan and masking them with U.S. VPN endpoints. Slack discussions also show teams assigning AI-training work, using real residents to pass identity checks and remotely performing tasks through those residents' computers. Their broader infrastructure combines mandatory DPRK software, residential proxies, anti-detect browsers, VPS systems, KVM devices and audiovisual manipulation. Strong identity verification and periodic reverification remain important points of failure.