Material Threat Research Team:
Material matched known DPRK-linked email addresses and IP indicators against hiring activity at the organizations it monitors. Here is how far the suspected fake identities (“personas”) got.
Where DPRK-linked activity appeared
in the hiring process
Zooming out
Suspected DPRK-linked identities that contacted hiring teams at organizations Material monitors.
Breadth
This wasn’t just happening to Material customers. Running the same indicators against Material’s own recruiting pipeline revealed DPRK personas there too.
Nobody is too small, too technical, or too careful to be a target. That’s the scale of this operation.
Repeat identities
Each company sees only its own pipeline. A wider view can reveal the same identity moving through several. One persona was completing onboarding paperwork at one company while pursuing seven others.
How the scheme works
Five ordinary steps, each using the same remote-work
tools every legitimate hire goes through.
Operatives apply for remote roles using fake identities and email addresses tied to DPRK-linked infrastructure.
They interview over video like any other remote candidate, presenting the same persona at every stage.
To the employer, the candidate can look like a capable remote employee.
Once hired, they receive access to company systems, applications, files, and other cloud resources.
The goal may be the paycheck itself, with wages routed back to the DPRK regime. Data theft isn’t always required.
Because multiple people can operate behind one identity, the worker may appear unusually productive, responsive, or technically capable.
Some operatives may never exfiltrate data or trigger an obvious security event. Their goal may simply be to keep the job and collect the paycheck, but risk is present as long as the employee has access to systems.
Email can be the entry point, but once a fake employee is onboarded, the risk extends across the cloud workspace.
Their identity may now have access to shared drives, calendars, connected applications, files, permissions, and sensitive company data.
Read the threat research blogA fake employee can access
everything the employee identity
is connected to.
Blast radiusVolume is only half the picture. The question that decides the risk is access: who can reach these files, how widely they’re shared, and how much a new account could open without anyone approving it.
Real Organization #1
Roughly 15 million files flagged as source code and about 130,000 flagged with bank or routing numbers. Access here was comparatively tight: these files were held closely, shared with almost no one beyond their owners, which is the posture the other environments should be measured against. The first access question is which repositories and files the new role would receive.
Real Organization #2
Around 400,000 files flagged as containing Social Security numbers, 345,000 with bank or routing numbers, and several million source-code files. And the exposure was not hypothetical: 68% of those Social Security files, about 277,000, and 71% of the bank and routing files, about 248,000, were shared company-wide or by public link, reachable by any account inside the organization with no special permission. An insider would not have to reach for this data; it was already open.
Real Organization #3
About 14 million source-code files, of which roughly 1,900 were shared by public link, readable by anyone with the URL. At that scale, even a tiny fraction left openly shared is a meaningful amount of code.
Real Organization #4
Roughly 1.5 million source-code files and files flagged as containing private cryptographic keys. Even here the sharing had drifted: about 21% of its financial files and 17% of its credit-card files were shared company-wide or by public link. The smallest of the four environments still held material worth investigating closely.
From sensitive files in Google Drive to OAuth apps and AI agents, we find what an attacker or insider can reach, investigate who has access, and fix risky access automatically.
