North Korean IT worker fraud expands into healthcare and sales roles

North Korean threat actors are expanding their fraudulent remote employment scheme beyond IT into sectors such as healthcare and sales, according to new research from Huntress and Recorded Future.

The campaign, tracked under names including Famous Chollima, Jasper Sleet, and PurpleDelta, uses stolen identities, VPNs, and proxy services to trick companies into hiring remote workers who funnel income to Pyongyang’s weapons programmes. Huntress detailed cases in an Australian healthcare firm, a financial services company, and a sales and marketing hire, while Recorded Future found one cluster applied to jobs at over 1,100 companies.

The threat actors are increasingly using AI tools to generate personas and answer interview questions in real time. Eleven governments issued a joint alert urging companies to strengthen identity verification and background checks.