MEDIUM Threat Intel #North Korea #State Sponsored #Supply Chain Risk

PurpleDelta: North Korean IT Workers Exploit Remote Hiring

2026-08-18 16:25 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Organizations face risk of compromise and funding DPRK through fraudulent North Korean IT workers.
Affected systems: Primarily software/tech, staffing, and healthcare sectors hiring remote technical roles globally.
Remediation: Implement rigorous identity verification and continuous monitoring for suspicious post-hire activity.

Overview of PurpleDelta’s Fraudulent Employment Operations

Recorded Future’s Insikt Group has identified and designated a state-directed network of North Korean IT workers as ‘PurpleDelta’, actively engaged in sophisticated fraudulent employment operations. These operations aim to secure remote technical roles at organizations worldwide, systematically funneling earnings to finance North Korea’s sanctioned military and nuclear programs. The campaign demonstrates a high operational tempo and advanced persona management tradecraft, posing a material risk to companies, particularly those hiring for remote positions in the software and technology, staffing and consulting, and healthcare and biotechnology sectors, as reported by Recorded Future.

PurpleDelta overlaps with other vendor designations, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima, highlighting a recognized threat landscape. The activity indicates not only illicit revenue generation but also potential for intelligence collection, downstream compromise, and supply-chain risk, with observed overlaps with groups like PurpleBravo that deploy malware via fraudulent recruitment.

Technical Details and Analysis of PurpleDelta TTPs

PurpleDelta operators exhibit extensive and sophisticated tactics, techniques, and procedures (TTPs) to establish and maintain their fraudulent employment. Key observed TTPs include:

Persona Management and Deception

Operators have maintained at least 22 fabricated personas, some supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from illicit ID-generation services. These personas are deliberately constructed with aged accounts, curated technology stacks, and cross-platform social proof across platforms like GitHub, LinkedIn, Medium, and Upwork. To obscure their true nationality and affiliation, they utilize temporary phone number services (e.g., eSIM Plus, Blacktel, Google Voice) and anti-detect browsers, with many operators having a nexus in Shenyang, China.

High-Volume Application and Interview Tradecraft

One cluster of PurpleDelta operators applied to jobs at over 1,100 companies between late 2024 and early 2025, demonstrating an impressive operational tempo of up to 60 applications per day. They manage distinct personas simultaneously using multi-account management browsers and separate Google Chrome profiles, meticulously coordinating applications via detailed tracking spreadsheets. During job interviews, operators leverage screen recording software alongside AI transcription and chatbot tools to generate real-time answers, often repeating ChatGPT responses verbatim.

Post-Employment Activities and Infrastructure

Once employed, PurpleDelta operators record internal meetings and use tools like Google Translate to craft pre-written excuses for using personal devices and bank accounts for work. Coordination among operators occurs via Telegram and Slack, with facilitators identified as maintaining company-issued hardware. For payments, they steer transactions towards methods like GO2bank, PayPal, Payoneer, Rapyd, Stripe, and cryptocurrency. Infrastructure includes providers such as Hostinger, Namecheap, GoDaddy, IPRoyal, and Proxy-Seller. Operators consistently use Astrill VPN, a tactic known for circumventing China’s Great Firewall, and remote desktop tools like AnyDesk, Google Chrome Remote Desktop, Jump Desktop, and RealVNC to access maintained devices.

Actionable Recommendations and Mitigations

Organizations must enhance their hiring and onboarding security protocols to detect North Korean IT worker deception and mitigate associated risks. Defenders should prioritize the following:

Enhanced Identity Verification: Implement rigorous identity verification processes beyond standard background checks. This includes multi-factor authentication for identity verification, cross-referencing information across multiple public and private data sources, and scrutinizing identity documents for signs of fabrication, especially for remote roles.
Continuous Monitoring for Suspicious Behavior: Monitor newly hired remote employees for activities indicative of PurpleDelta TTPs. This includes attempts to use personal devices or bank accounts for work, requests to steer payments to specific platforms, unusual remote access patterns, and consistent use of AI tools during work processes or interviews.
Deep Background Checks: Conduct in-depth background checks that go beyond basic employment history. Verify educational credentials, previous employment references, and professional social media presence with independent sources. Be wary of profiles that appear overly curated or lack genuine interaction.
Network and Endpoint Security: Implement strict network segmentation and endpoint detection and response (EDR) solutions. Monitor for connections to known VPN services (like Astrill VPN) or remote desktop tools used by operators if not explicitly authorized. Restrict software installation and access to internal resources on company-issued hardware.
Employee Education and Awareness: Train hiring managers and HR personnel to recognize the signs of sophisticated social engineering and persona management tactics employed by state-sponsored groups. Educate current employees on potential insider threats and the importance of reporting suspicious requests or activities from new team members.

#North Korea #State Sponsored #Supply Chain Risk

X/Twitter LinkedIn Reddit HN

← Back to Articles