SentinelLabs has identified multiple deceptive websites linked to businesses in China fronting for North Korea's fake IT workers scheme.

Executive Summary

  • SentinelLabs has identified unique characteristics of multiple websites, now seized by the US Government, associated with the DPRK IT Worker front companies.
  • We assess with high confidence that DPRK actors seek to impersonate US based software and technology consulting businesses by copying the online brands of legitimate organizations, seeking to use these for financial objectives.
  • SentinelLabs has linked the activity to several active front companies and links these with high confidence to a larger set of organizations being created in China. Our findings link additional companies, which remain active today, to the DPRK IT Workers scheme.