Who is Gary from IT, really?

11 minutes ago

6 min read

North Korea earns hundreds of millions of dollars by getting undercover workers hired into remote jobs at Western companies. On Friday Australia sanctioned two North Koreans and two dodgy companies over exactly this sort of stuff.

(First published on my Substack where you can get #NerdNews, marvellous maths and general geekery.)

('Is that you Gary?': created by the author using midjourney)

Sign of the times.

Sometimes in the NerdNews universe, things just line up perfectly. Over the weekend I was listening to one of my favourite podcasts, PJ Vogt’s Search Engine, which revived a topic that has always fascinated me: the ability of the deep North Korean state to implant workers in companies in the West.

And would you believe it? Just Friday of last week, Australian authorities fingered two Mr Bigs of the global bogus North Korean employee industry. Let’s unpack this juicy, duplicitous tale.

Not their first rodeo.

This whole industry of placing North Korean workers in firms in the West is the latest in a long line of attempts by the cash-strapped country to push back against harsh international sanctions. We have already described in a previous NerdNews the Lazarus Group, some of the world’s very best ransomware hackers, and the nefarious deeds they have got up to in bringing US dollars and Bitcoin back to Pyongyang.

More recently, and especially during and since the pandemic, another part of their malicious machinations has been to place loyal North Korean workers in Western firms, in particular US firms that skew towards tech and cryptocurrency.

PJ Vogt’s Search Engine spoke extensively to Sam Kessler, a Wall Street Journal reporter who has spent the last couple of years unravelling these schemes worldwide. Kessler said the post-COVID habit of hiring people you never meet gave the workers a way in. Nine security officials told Axios in 2025 that they had yet to meet a Fortune 500 company that had not accidentally hired one.

And it is really not that easy to spot these slick operations. The security training company KnowBe4 hired such a worker in 2024 after detailed background checks, verified references and four video interviews. It turned out the man had used a real stolen American identity and an AI-enhanced photo.

“They’re going to use AI to magnify exponentially what they’re already doing.” — Michael “Barni” Barnhart, principal investigator, DTEX Systems, to Axios.

Fake it until you make it.

In a fascinating revelation, Kessler’s colleague Emma Scott came into possession of data from a computer used by a North Korean bogus hiring cell. When inspecting screen recordings of job interviews, half the screen showed a Google Meet call with the interviewer and the other half showed ChatGPT. The worker would paste in a live caption of each question, stall for a couple of seconds with awkward small talk, then read out ChatGPT’s answer.

“This isn’t something I’d ever seen before, which is why it was so incredible.” — Sam Kessler, reporter, The Wall Street Journal, on Search Engine.

Occasionally, interviewers do get suspicious. One asked a candidate what the weather was like where he lived. The recording shows the candidate laughing nervously while desperately looking up the temperature in the town where he claimed to be.

Not as bad, I guess, as the North Korean worker who claimed he couldn’t come into work one day because there had been an earthquake where he lived. A quick search online showed no such earthquake activity.

Meet the many Michael Browns.

It is important to understand that these are not just bored individuals having a laugh. This is a serious industry, one that steals identities and uses them multiple times to infiltrate various organisations. Take the case of the many Michael Browns.

Michael Brown is a real American. But one day, when he went to the Department of Labor to look into unemployment benefits, he learned that nine (that’s right, nine) companies were listed as currently employing him, including a contract role at Amazon that he simply didn’t hold.

Twelve months after discovering a North Korean cell using his ID, the real Michael Brown still can’t get a bank account, rent a property or take out a college loan for his daughter. He is just one of who knows how many real people, sometimes even dead people, whose identities have been stolen by these North Korean employment hustlers.

Kim Jong-un is a big fat pig!

While I am willing to commit to print nasty things about the despotic ruler of North Korea, potential North Korean plants in Western companies often are not. It has become a trick interviewers use if they have a suspicion about someone’s bona fides.

They will say, “Look, I know this sounds bizarre, but would you just be willing to say that Kim Jong-un is a big fat pig?. We just need to check you’re not a North korean plant.

It is fascinating to see the many videos online of would-be job applicants squirming to avoid making a statement that you might assume someone passing themselves off as not being North Korean should be willing to make to secure a lucrative job.

But if you think about the situation they are in, maybe it’s a bit easier to understand their reticence.

“When you read stories about how Kim Jong-Un has responded to insults or threats internally, which is almost always death, I think it makes sense … a lot of what is motivating these people is fear - fear for thier own safety or their families.” — PJ Vogt Search Engine Podcast.

How the sausage is made.

These sophisticated operations take a team. North Korean workers pick identities to assume, often stolen from a real person and sometimes from a dead one. They then apply for remote jobs through platforms such as LinkedIn, Fiverr and Freelancer, and the Axios reporting describes them using AI tools to polish their applications.

Next comes the laptop. Employers issue laptops to the new hires, and those laptops are shipped to US addresses controlled by American accomplices, running what are known as laptop farms. The accomplices install remote access software so the worker can operate the machine from abroad, while the employer believes the worker is in the United States. Some operatives have even filed false police reports claiming a laptop was stolen so the employer sends a replacement to a farm address, or changed the delivery address at the last minute on a laptop already in transit. The wages are then moved to accounts controlled by North Korea.

('The Sausage Factory': created by the author using midjourney)

The Americans are the visible end of the scheme. On 13 October US prosecutors announced a Texas operation in which the FBI searched more than 40 homes and seized 187 laptops and other devices.

It is not clear how many American facilitators know they are aiding the despotic regime. Some may have been duped into thinking they were helping an innocent overseas coder who just can’t get a visa, or assisting a team who were not great at English, but sick at software, win a remote contract. Others might know it’s a bit suss, but be genuinely surprised, as one intermediary featured on the pod was, when the truth beomes apparent.

“Dude, these guys are in a shadier business than I thought. I mean, how did I get involved in shit like this man.” — intermediary Derek Goon.

The Aussies angle.

Just when you might be thinking it’s only American workers and organisations that North Koreans might try to dupe, no, no, no, don’t worry. There’s some bogus job love coming Australia’s way as well.

Just last Friday, we sanctioned two North Koreans, Yu Pu Ung and Sim Hyon Sop, and two companies, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company (don’t mind jamming a few words into a company title, do they, the old North Koreans?), over schemes that placed IT workers in remote jobs abroad.

Australia’s Sanctions Office said that, similar to US identities, job applicants are using stolen and doctored Australian driving licences and passports, and have approached local companies through online platforms and various recruitment firms.

The office advises businesses not to rely on recruiters’ checks alone.

Australian security firm DTEX estimates the worldwide take is pushing up towards a billion dollars Australian. Further, DTEX notes that in March this year, Nick McKenzie, appearing on Nine’s 60 Minutes, posed as a recruiter for an Australian development role and caught a suspected facilitator linked to known North Korean schemes in a staged interview.

And of course there’s potential, beyond the simple dollars and cents, for stolen corporate secrets, espionage and the like. To be honest, these North Korean crims tend to play for keeps.

“This is a state-linked operation designed to get people inside real businesses.” — Mohan Koo, president and co-founder, DTEX, to IT Brief Australia.

The Wall Street Journal documentary behind the episode is worth watching to see the interview screens.