1/ An unnamed source recently compromised a DPRK IT worker device...
ZachXBT@zachxbt
4 views
Aug 13, 2025
~2 min read
1
1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects.
2
2/ An export of their Google Drive, Chrome profiles, and screenshots from their devices was obtained.
Google products were extensively used by them to organize their team’s schedules, tasks, and budgets with communications primarily in English.
Google products were extensively used by them to organize their team’s schedules, tasks, and budgets with communications primarily in English.
3
3/ Another spreadsheet shows weekly reports for team members from 2025 which provides insight into how they operate and what they think about.
“I can't understand job requirement, and don't know what I need to do”
“Solution / fix: Put enough efforts in heart”
“I can't understand job requirement, and don't know what I need to do”
“Solution / fix: Put enough efforts in heart”
4
4/ A spreadsheet for expenses shows them purchasing SSNs, Upwork/LinkedIn accounts, phone numbers, AI subscriptions, computer rentals and VPNs/proxies.
5
5/ Here is a spreadsheet that shows the meeting schedules for jobs and a script used for the fake identity ‘Henry Zhang’
6
6/ The DPRK ITWs would purchase Upwork & LinkedIn accounts, buy or rent a computer, and then use AnyDesk to conduct work.
7
7/ One of the wallet addresses used by them to send and receive multiple payments was
0x78e1a4781d184e7ce6a124dd96e765e2bea96f2c
0x78e1a4781d184e7ce6a124dd96e765e2bea96f2c
8
8/ The 0x78e1 address is closely tied onchain to the recent $680K Favrr exploit from June 2025 where their CTO and other devs turned out to be DPRK ITWs with fraudulent documents.
Additional DPRK ITWs were identified at projects from the 0x78e1 address.
x.com/zachxbt/status…
Additional DPRK ITWs were identified at projects from the 0x78e1 address.
x.com/zachxbt/status…
9
9/ Other interesting items from their searches and browser history included:
10
10/ Still one of the more common questions is “how do you know they are North Korean?”
Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP.
Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP.
11
11/ The main challenge faced in fighting DPRK ITWs at companies include the lack of collaboration between services and the private sector.
There’s also the negligence by the teams hiring them who become combative when alerted.
ITWs are in no way sophisticated but are persistent since there’s so many flooding the job market globally for roles.
Payoneer is commonly being used to convert fiat into crypto from dev work.
I have already covered multiple times on indicators of what to look out for so I will not repeat those again.
There’s also the negligence by the teams hiring them who become combative when alerted.
ITWs are in no way sophisticated but are persistent since there’s so many flooding the job market globally for roles.
Payoneer is commonly being used to convert fiat into crypto from dev work.
I have already covered multiple times on indicators of what to look out for so I will not repeat those again.