North Korean PurpleDelta Network Exploits Remote Hiring for Fraudulent Employment

Insikt Group has identified PurpleDelta, a North Korean IT worker network, employing over 22 fabricated personas to apply for jobs at more than 1,100 companies, likely securing positions at ten or more organizations. The operators utilize AI-generated profile photos, illicit identity documents, and advanced tools like multi-account browsers and custom ChatGPT assistants to bypass remote hiring controls. Once hired, they recorded internal meetings and maintained access through personal devices, posing significant risks to proprietary data and internal communications. This ongoing activity is expected to expand as AI and identity services become more accessible. Companies should review employment histories and access privileges of individuals matching the identified indicators to mitigate risks.

Key Points: • PurpleDelta operators applied to over 1,100 companies using 22 fake identities. • They employed advanced tools like AI-generated photos and custom ChatGPT assistants. • The ongoing operations pose significant risks to data security and internal communications.