We found North Korean IT-worker personas applying at the companies…

We spent a year tracking suspected North Korean IT-worker personas through the hiring pipelines of the companies we monitor. 2,429 applied. 1,100 got to an interview or later. 27 reached onboarding: offer letters, background checks, equipment requests, or first-day IT setup.

In the last 30 days, 232 made contact with 99 organizations. 42 of those got an interview or an offer. Four reached onboarding.

41% applied to more than one company. Fifteen applied to ten or more, and one applied to nineteen. One was filling out onboarding paperwork at one company while going after seven others. Every company only sees its own pipeline, so none of them could see that.

We ran the same indicators against our own recruiting pipeline, and they were there, too.

Then we looked at what was sitting inside the four companies where one got to onboarding. The first had about 15 million source code files and 130,000 files with bank or routing numbers, and almost none of it was shared beyond the owners.

The second had around 400,000 files with Social Security numbers, and 68% of them were open company-wide or by public link. So were 71% of its bank and routing files. A new account there would not have had to look for anything.

The third had about 14 million source code files, with around 1,900 shared by public link. The fourth had 1.5 million source code files and private cryptographic keys, and 21% of its financial files and 17% of its credit card files were shared beyond their owners.

Same people trying to get in. The difference between those four was how each company had handled sharing before anyone applied.

For each of them, the next question is what the account was given and what it did. If one of these got hired at your company next week, could you list everything their account can open?

Full research: https://material.security/dprk-insider-threat

Impact

The impact includes the potential for North Korean operatives to gain legitimate employment and access to sensitive company data, including source code, financial information, Social Security numbers, bank routing numbers, and cryptographic keys. The extent of exposure varies by company based on internal data sharing practices. In some cases, sensitive files were widely shared within organizations, making them accessible to new employees without additional permissions. The threat could lead to insider data theft, espionage, or other malicious activities, although some operatives may only seek paychecks without triggering obvious security events. The scale and persistence of the operation increase the risk to affected organizations.

Defensive guidance

No official vendor advisory or patch is applicable as this is an insider threat scenario. Organizations should review and tighten internal access controls and file sharing policies to limit exposure of sensitive data. Monitoring hiring pipelines for suspicious or repeated applicant identities across companies could help detect such coordinated attempts. Companies should audit permissions granted to new hires, especially those onboarded remotely, and verify the scope of access to sensitive files and systems. Awareness and training for HR and security teams on this threat can improve detection and response. Since the threat involves legitimate access gained through hiring, technical controls combined with procedural vigilance are essential.

Summary

Material Security tracked suspected North Korean IT-worker personas applying to monitored companies over a year. Out of 2,429 applications, 1,100 reached interviews or later stages, and 27 reached onboarding, gaining access to company systems. These personas used fake identities linked to DPRK infrastructure and applied to multiple companies, sometimes simultaneously. The research found that the risk posed by these fake employees depends heavily on how companies manage internal file sharing and access controls. Some organizations had tightly controlled sensitive data, while others had large volumes of sensitive files shared widely within the company, increasing exposure risk. The threat involves gaining legitimate access through hiring pipelines, potentially allowing access to sensitive source code, financial records, and personal data. The operation is ongoing and affects a broad range of organizations, including Material's own recruiting pipeline.

We found North Korean IT-worker personas applying at the companies we monitor and 27 got to onboarding

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 13 Nov 2026, 01:38 UTC

Technical details

References

Community reviews

Related threats