How 30+ Fake Identities Created by North Korean Operatives Were Exposed Through Device Breach

Security researcher ZachXBT has disclosed a significant discovery: confidential device data from North Korean IT personnel revealed an organized operation employing over 30 fabricated identities across multiple platforms. The accessed information—including Chrome browser profiles, Google Drive backups, and system screenshots—painted a picture of a coordinated team securing developer roles through fraud.

The Scale of the Operation

The scope extended beyond simple account creation. These operatives systematically acquired Upwork and LinkedIn credentials using government-issued identification documents, then managed their activities via AnyDesk remote desktop software. One particular wallet address, 0x78e1, emerged as directly connected to a $680,000 theft targeting the Favrr platform during June 2025, establishing clear links between the social engineering infrastructure and financial theft.

Infrastructure and Methods Uncovered

The accessed systems revealed how the team orchestrated their activities. They leveraged Google’s suite of tools for task scheduling while simultaneously purchasing SSNs, AI service subscriptions, and VPN access through illicit channels. Browser history logs indicated extensive reliance on Google Translate specifically for converting text to and from Korean, while geolocation data traced many connections through Russian IP addresses—a common obfuscation tactic.

Systemic Vulnerabilities Exposed

Beyond the technical tactics, the breach highlighted organizational weaknesses. Recruiters and platform moderators failed to detect obvious red flags across multiple identity variations. The lack of cross-platform intelligence sharing and identity verification coordination created gaps that allowed the same individuals to maintain parallel personas across freelance networks.

This incident underscores how combining social engineering with infrastructure obfuscation remains an effective attack vector when institutional defenses operate in isolation.