The Wall Street Journal has released an investigative film titled Infiltrated: North Korea’s Secret U.S. Workforce, which reveals a hidden network of North Korean workers operating within American companies.
This investigation is based on leaked information from a North Korean cell, including browser histories, emails, calendars, and screen recordings.
According to WSJ, the FBI has identified thousands of such "job seekers" across the United States. The group monitored by the publication sent applications to over 1,000 companies within three months, employing artificial intelligence at nearly every hiring stage—from cover letters and resumes to interview preparation and identity substitution.
American intermediaries play a crucial role in this operation. Corporate laptops remain in the U.S., while North Korean workers connect to them remotely.
These accomplices open bank accounts, cash checks, and sometimes even participate in parts of interviews. One Ohio resident told the newspaper that he attends work meetings while North Koreans perform the actual job. They shared a salary of $75,000 a year equally.
In some instances, stolen identities of Americans are used for background checks during hiring. WSJ reports that workers may simultaneously manage multiple "foreign" profiles and apply for several jobs under each name.
The publication highlighted a Georgia resident who claimed his information was sold online and used to secure jobs across the country. As a result, he is now unable to open a bank account, obtain credit, or rent a home.
Journalists also discovered that some of the salaries are funneled to the North Korean authorities. The U.S. Treasury Department notes that certain North Korean IT workers earn up to $300,000 annually, with about 90% of these funds going to the regime.
Recent estimates suggest that this entire scheme could generate up to $800 million per year. The investigation traced the flow of money through the network of North Korean IT workers and cybercriminals to a company that has been sanctioned by the U.S. due to Pyongyang's weapons program.
Additionally, in August, specialists from Genians found that North Korean hackers had integrated local AI into attacks targeting cryptocurrency firms.