Using AI to Answer Interview Questions and Alter Faces: North Korea Refines Methods to Infiltrate US Remote Jobs

WSJ Tracks Operation for One Year: 1,000 Applications, 9 Offers

American Accomplices Receive Laptops; 39 Indicted

Estimated 1,000 to 2,000 North Korean IT Workers Overseas

There have been reports that North Korean information technology (IT) personnel are refining sophisticated methods to gain disguised employment with American and British companies using artificial intelligence (AI).

Image to aid understanding of the article. Pixabay

On August 12 (local time), Yonhap News, citing The Wall Street Journal (WSJ), reported that “North Korea has been building a covert workforce within American companies.” The article explained that “to make money for the Kim Jong Un regime, North Koreans have fraudulently secured remote jobs by exploiting stolen identity data, AI tools, and accomplices within the United States.”

The WSJ tracked a small team led by an individual using the codename “Eagle Vision” for over a year. The newspaper obtained browser records, emails, stolen personal information, and recorded videos of job interviews, publishing the findings in both a documentary and an article that unveiled the methods used for employment fraud. Over a period of just over three months, the team reportedly sent applications to more than 1,000 companies in the United States and the United Kingdom and received at least 9 job offers.

AI was used in most stages of the application process. In released interview recordings, one IT worker was seen asking ChatGPT for answers to software engineering questions just before an interview. As hiring managers became better at detection, AI tools capable of altering facial images were also employed.

“Thousands of Americans Involved”... 39 Indicted Over 'Laptop Farms'

In the next stage after hiring, American accomplices become involved. Once a company sends a work laptop to such an accomplice, the North Korean group pays for it and accesses the device remotely, a method commonly referred to as a “laptop farm.”

In the WSJ documentary, an FBI official stated, “North Korea needs partners inside the United States to receive these laptops,” adding, “Our team has arrested or indicted a total of 39 Americans, both North Korean IT workers and those who supported the ecosystem.” Another FBI agent said, “The largest laptop farm we have uncovered so far involved about 100 laptops,” noting that “even if each laptop farm only has a few dozen devices, for these operations to function, thousands of Americans would need to be involved.”

Accomplices not only open bank accounts and cash checks but may also appear on video calls in company meetings as a stand-in for the North Korean worker. One man from Ohio disclosed that he personally attended meetings and shared a job worth 75,000 dollars (about 100 million won) with another person. Damage to victims whose identities were stolen has also been confirmed: a man in Georgia said that after his personal information was stolen, he was unable to open bank accounts, obtain loans, or rent housing.

Funds Flow to North Korea via Cryptocurrency... FBI: “Used for WMD Development”

Image showing the identity laundering process featured in the Wall Street Journal documentary video about North Korea's disguised IT employment. YouTube

Some North Korean IT personnel have earned up to 300,000 dollars annually (about 430 million won) using these methods. The funds are transferred to North Korea through a web of overseas bank accounts, delivery services, cryptocurrency transactions, and money launderers. The WSJ traced the cryptocurrency wallets linked to “Eagle Vision” and discovered connections to firms sanctioned by the United States for involvement with North Korea's weapons programs.

An FBI official stated, “In some cases, the U.S. Treasury Department has confirmed that up to 90% of the earnings from these schemes go back to the North Korean regime,” adding, “While individuals do not make large sums, collectively, millions of dollars are flowing into North Korea’s weapons of mass destruction (WMD) and missile development programs.”

According to a report from the Multinational Sanctions Monitoring Team (MSMT) in October last year, it is estimated that between 1,000 and 2,000 North Korean IT workers are operating overseas. Of these, about 1,000 to 1,500 are concentrated in China, while others are dispersed across at least eight countries, including Russia and Laos. It is estimated that in 2024 alone, these workers generated between 350 million and 800 million dollars in foreign currency (roughly 500 billion to 1.1 trillion won). Most of these organizations are reportedly under the Reconnaissance General Bureau, an entity sanctioned by the United Nations Security Council.

This content was produced with the assistance of AI translation services.