Thousands of North Koreans are using fake identities to land remote work opportunities on LinkedIn

11/28/2023 / By Arsenio Toledo

Thousands of tech-savvy North Koreans are using fake names and carefully crafted interview scripts to sign up for remote work opportunities on LinkedIn.

This is according to a report published by Reuters, which uncovered documents proving that North Koreans are landing jobs outside of the hermit communist nation to secretly earn hard currency for the nation. (Related: LAZARUS HEIST: The international ATM theft that bagged $14M in just over 2 hours.)

In recent years, North Korea has used one of its untapped resources to its advantage: its people. The communist nation has dispatched thousands of IT workers overseas in an effort that has accelerated in the last four years to bring in millions of dollars to help finance Pyongyang’s military programs. These include the country’s nuclear weapons program.

With the rise in remote work, Pyongyang has found a way to send even more of its population to work for corporations to earn money for the state. This program, dubbed “Wagemole,” involved disguised North Koreans accepting remote work opportunities from American, European and even Asian companies, working in mostly information technology roles.

This scheme was first discovered by Palo Alto Networks, a cybersecurity firm. The company found a cache of data accidentally left unsecured by one North Korean hacker. This data included resumes for 14 different fake identities, one forged American green card and strong evidence “that some workers had bought access to legitimate online profiles in order to appear more genuine.”

Reuters followed up on this information by tracking down one North Korean IT worker who participated in the Wagemole scheme. This whistleblower, speaking under anonymity, reported that he and his colleagues were expected to land remote IT jobs paying at least $100,000 a year.

He reported that 30 percent of their income immediately went to Pyongyang, and they were then billed anywhere between 40 to 60 percent more for various alleged “expenses,” leaving the workers to keep only between 10 to 30 percent of their actual income – which is still a lot more than what they could have earned due to North Korea’s vastly lower standard of living.

Interview scripts provide ways for North Koreans to hide their identity

The interview scripts being provided to prospective North Korean employees are over 30 pages long and were originally unearthed by Palo Alto Networks. The scripts provided North Korean remote workers with answers to popular interview questions.

One uncovered LinkedIn profile for a North Korean posing as an American senior embedded software developer named “Richard” even provided him and his potential employer with an excuse for the need to work remotely.

“I [flew] to Singapore several weeks ago. My parents got COVID and I [decided] to be with family members for a while,” reads the script. “Now, I am planning to go back to Los Angeles in three months. I am thinking that I could start work remotely right now, then I will be on board when I go back to LA.”

These interview scripts were able to get dozens – possibly even hundreds – of North Koreans job contracts that lasted anywhere from six months to three or four years. These contracts were for firms from all over the world, including Chile, New Zealand, the United States, Uzbekistan and the United Arab Emirates.

North Korean remote workers unable to land full-time and semi-permanent contracts were ordered to work as freelancers. California-based cybersecurity firm Constella Intelligence found evidence of one North Korean who had active accounts at more than 20 different websites for freelance IT workers.

Watch this clip from TruNews reporting on North Korea’s new spy satellite and how it’s being used to spy on U.S. military bases.

This video is from the TruNews channel on Brighteon.com.