INVESTIGATION: Kim Jong-un Had His Hackers Inside Your Offices — 167,000 Applications, 76 Jobs Obtained

The Moment Everything Changed for Nisos

In 2024, a candidate for an AI architect position applied to Nisos, a cybersecurity firm based in Virginia. He stumbled through his answers, changed the subject when asked to share his screen, and claimed to live in Florida while his metadata placed him elsewhere. Nisos didn't reject him. Instead, the firm sent him a booby-trapped laptop, monitored every keystroke, and began mapping what turned out to be one of the most sophisticated employment fraud operations ever documented against Western companies.

The report published on June 16, 2026 is explosive: a cell of 22 North Korean agents submitted at least 166,893 applications, secured 21,645 interviews and obtained 76 real job offers from American companies between December 2024 and September 2025. This isn't conventional cyberwarfare. It's industrial infiltration disguised as job-seeking.

A Network Structured Like a Business

The Democratic People's Republic of Korea leaves nothing to chance. According to Nisos, the cell operated with a formal hierarchy: administrators, managers, team leaders, field operators, and American facilitators — referred to as "natives" in internal communications — recruited on U.S. soil to physically participate in video interviews, manage employer-issued computers, handle drug screening tests, and facilitate administrative onboarding.

Internal communications flowed through Discord, Telegram, and WhatsApp. Agents used three-letter initials to protect their identities. Everything was conducted exclusively in English to avoid triggering foreign-language detection. Performance dashboards tracked application-to-interview-to-offer conversion rates, exactly like a sales center.

There is something deeply unsettling about this image: agents of a totalitarian regime precisely mimicking the rituals of liberal capitalism — the dashboards, the quotas, the performance reviews — to infiltrate that very system from within. Pyongyang understood Silicon Valley's codes better than some Silicon Valley recruiters did.

An Industrial Ratio: 7,586 Applications Per Operator

With 22 operators identified, each was responsible on average for 7,586 applications, 984 interviews, and 3.5 job offers. The application-to-interview conversion rate was 13%, which is remarkably high for a large-scale fraud. The interview-to-offer conversion rate remained low — 0.35% — but volume compensates for everything. These numbers are not the product of improvisation. This is pure volume, applied with factory-floor rigor.

The roles targeted were heavily concentrated in software development, engineering, and data — more than 70% of positions pursued. Targeted salaries ranged from $55,000 to $230,000 per year. The technology sector accounted for 42.6% of offers obtained, followed by consulting, healthcare, and financial services. The reason is simple: tech roles offer high salaries, a well-established remote work culture, and an often inadequate vetting process.

Two Convicted American Facilitators

In May 2026, the U.S. Department of Justice convicted two American citizens for their roles in separate but similar operations. Matthew Isaac Knoot, of Nashville, and Erick Ntekereze Prince, of New York, were each sentenced to 18 months in prison. Together, their operations had generated more than $1.2 million for the North Korean regime and compromised nearly 70 victim companies across the United States.

These convictions illustrate a central element of the system: without local facilitators, the operation doesn't function nearly as well. North Korean agents need Americans to receive laptops, appear at video interviews, and complete physical testing. This isn't science fiction — it's a human supply chain for fraud.

The conviction of Knoot and Prince is symbolically important, but it changes little about the scale of the problem. Two people behind bars against an operation that produced 76 jobs obtained and which, according to CrowdStrike, doubled its volume of attacks in 2025. The balance of power remains absurdly lopsided.

Artificial Intelligence in Service of Pyongyang

North Korean operators didn't rely solely on their own interview skills. They used accent training tools to mask their linguistic origins, remote access technologies to control computers from abroad — presumably from China or Russia — and AI-powered deepfakes during video interviews to present a convincing American face. According to Nisos, the infrastructure also included identity brokers, networks for buying and selling stolen identities of real Americans.

The laptop farm is the physical element that reveals the full ingenuity of the system. Companies ship their corporate equipment to a U.S. address — that of a paid facilitator. The facilitator connects the computer to the internet and allows the North Korean operator, thousands of miles away, to access it remotely. For the company, the geolocation is perfect. For authorities, it is nearly undetectable without targeted surveillance.

Operational Infrastructure Worthy of a Small Business

Nisos describes a Discord infrastructure organized into distinct channels: an applications channel, a training channel, an identity management channel, a performance channel. Agents received precise instructions on what questions to anticipate, what answers to prepare, and what software to master for common tech roles. This level of organization far exceeds what one would expect from an improvised criminal operation. It's a structured fraud enterprise with internal HR processes.

Payments to American facilitators were routed through ERC20 cryptocurrencies — traceable in theory, but difficult to follow in practice when wallets are multiplied and mixed. The ultimate goal is always the same: circumvent international sanctions and fund Kim Jong-un's weapons program, in particular the development of ballistic missiles and nuclear weapons.

What strikes me most is that these operations target precisely the most open, most progressive, most trusting sectors of the American economy — tech startups, scale-ups, data firms. These aren't defense companies with strict protocols. They're teams that hire fast, remotely, on the strength of a résumé and a Zoom call. Pyongyang identified their Achilles heel with surgical precision.

From a Few Hundred to Thousands of Active Operators

The Nisos report documents a specific cell, but the phenomenon is far broader. According to the United Nations, North Korean IT workers generate between $250 million and $600 million per year for the regime, active in more than 40 countries. South Korea's National Intelligence Service reported that Pyongyang's cyber division grew from 6,800 agents in 2022 to 8,400 in 2024. CrowdStrike identified 45 distinct operations linked to North Korean IT workers in March 2026 alone — up from 33 in March 2025. The acceleration is massive.

The law firm Skadden published an analysis in June 2026 detailing the legal risks for companies that inadvertently hire these agents: potential sanctions violations, cybersecurity risks, criminal liability, and reputational damage. More than 40 individuals have been indicted by the DOJ in these operations, including American citizens, Chinese nationals, and Taiwanese nationals.

Operation Famous Chollima — The Name the Industry Won't Forget

CrowdStrike designates the operation under the name Famous Chollima — a reference to the winged horse of Korean mythology, a symbol of speed and power. The name is well chosen: the operation moves fast, very fast, and strikes everywhere at once. In 2025, the volume of attacks doubled compared to the previous year. The DOJ announced in June 2025 nationally coordinated actions including raids on 29 laptop farms across 16 states, the seizure of 29 financial accounts, and 21 fraudulent websites.

These operations are far from anecdotal. Some North Korean operators access sensitive systems, intellectual property data, and source code infrastructure. These are not merely salary scams — they are data theft vectors and potentially long-term sabotage tools for a regime that considers the West its principal enemy.

North Korea has been waging unconventional economic warfare for years, and the West still has no systemic response. We punish two Americans here, raid a few laptop farms there. Meanwhile, 22 agents from a single cell submitted 167,000 applications and landed 76 jobs. This isn't a war you win with one-off actions.

Remote Hiring Culture as a Blind Spot

The COVID-19 pandemic normalized remote work at a speed that security departments couldn't keep pace with. In 2020, tech companies massively adopted fully online hiring processes: résumés, video interviews, digital onboarding. For an operation like Famous Chollima, this was ideal terrain. There's never a handshake, never a photo badge, never a physical identity check. Just a convincing LinkedIn profile, a solid résumé, and an agent trained to ace technical interviews.

The warning signs documented by the FBI and Nisos are clear: refusal to appear on unplanned video, a background that never changes, requests for a specific laptop hosting service, inconsistencies in identity information, multiple workers connecting from the same IP address. These markers are known. But at a startup hiring 20 developers a month, who has the time to verify them all with this level of scrutiny?

The Financial Sector in the Crosshairs for 2026

According to Fortune and CrowdStrike, North Korean adversaries have become in 2026 the primary nation-state intrusion threat for companies in the American financial sector. Financial services firms, consumer banks, and their service providers are now in the crosshairs — far more sensitive targets than tech startups. Access to banking systems via infiltrated employees would represent a major qualitative leap for Pyongyang's illicit financing program.

The Nisos report of June 2026 may be the most detailed warning ever published on this type of operation. But the fact that it required Nisos to deliberately accept a suspicious agent, send him a booby-trapped laptop, and monitor his activities for months to obtain this data says everything about the difficulty of passive detection. Ordinary companies have neither the resources nor the counterintelligence culture to run this type of operation.

One could simplify the problem this way: American companies built their hiring processes to find the world's best engineers, not to detect agents of an enemy state. That's not a criticism — it's an observation. But the world has changed, and hiring protocols must change with it.

The DOJ Is Accelerating but It Isn't Enough

The Department of Justice has ramped up actions since 2024: indictments of North Korean, Chinese, and Taiwanese nationals, convictions of American facilitators, seizures of accounts and computer equipment. But these actions remain reactive: they intervene after operations have run for months or years. And for every cell exposed, how many others are quietly operating inside companies that didn't have Nisos's luck or instincts?

The FBI now offers a reward of $5 million for any information leading to the arrest of members of these networks. The FBI, State, and Treasury agencies have published joint advisories detailing red flags. But the tech startup ecosystem — with its hundreds of thousands of companies, decentralized hiring processes, and default-trust culture — is structurally difficult to protect through government advisories.

What Companies Can Concretely Do

The recommendations from Skadden and Nisos converge: require at least one physical verification before hiring, use deepfake detection tools during video interviews, ship computer equipment only to the address on official identity documents, tie corporate access to verified physical devices, analyze connection patternsinternal reporting systems. These measures are not technically complex. They mainly require an organizational will to take the risk seriously.

The real question is one of collective responsibility. Companies that inadvertently hire North Korean agents are not criminals — but they are objectively funding a weapons program that threatens regional and global security. There is a moral and strategic obligation to treat this risk with the same rigor as any other compliance or cybersecurity risk.

I have no illusions about the priorities of a hypergrowth startup. When you're hiring 10 developers a month and have an 18-month runway, counterintelligence vetting isn't at the top of your list. But if 76 jobs were obtained by a single cell, and the UN estimates the annual revenues of this program at between $250 million and $600 million, we need to call it what it is: a tax imposed by Pyongyang on the Western tech economy.

A Program Indispensable for Funding Kim Jong-un

North Korea lives under one of the most severe international sanctions regimes in the world since the acceleration of its nuclear program. Legitimate exports are virtually nonexistent. The country depends on a combination of trafficking, cybercrime, and fraudulent employment operations to fund both the government and its weapons development. The remote IT worker program has become one of the most profitable and hardest-to-detect revenue streams.

The link between fraudulent salaries and intercontinental ballistic missiles is direct and documented. In 2026, Kim Jong-un personally visited a weapons production plant and called for multiplying missile production capacity by 2.5. He also inaugurated a new nuclear materials factory. This is no coincidence: revenues from cyberespionage and employment fraud directly feed these programs. The American tech companies that hired an agent from the Nisos cell were, unknowingly, contributing to this acceleration.

A Challenge to the International Order

This type of operation raises a fundamental question for the international order: how do you contain a state determined to circumvent all sanctions when its primary circumvention tool is indistinguishable from a normal employee? China and Russia host a large proportion of these operators — without the cooperation of both countries, any American judicial action remains structurally limited.

The international community is discussing information-sharing mechanisms between companies, between governments, and between sectors. But North Korea has a head start: it improves its tools and processes faster than regulators can document them. The Nisos report of June 2026 describes an operation that ran between late 2024 and late 2025. Meanwhile, new cells — with lessons learned from that cell's exposure, with new protocols, new AI tools, new identities — are almost certainly already at work.

What I observe is an asymmetric war that the West hasn't yet formally declared. North Korea infiltrates our companies, steals our salaries, funds its bombs — and our primary response consists of sentencing two facilitators to 18 months in prison and publishing security advisories. We need to name the thing: this is an attack on our economy, carried out by an enemy state, and it demands a strategic response, not just sporadic prosecutions.

From Tech Startups to Financial Institutions

The evolution documented by CrowdStrike is concerning: in 2025, the Famous Chollima operation not only doubled its volume, it also broadened its targets. Banks, insurance companies, fintechs, and asset managers are now explicitly in scope. An agent embedded in a financial institution has access to far more valuable data — payment systems, customer databases, SWIFT infrastructure, transaction data. The qualitative leap is considerable.

It is also likely that these operations will evolve toward extortion: an agent already in a position, with access to sensitive data, could threaten to leak it if their identity is about to be discovered. Cases of extortion by former North Korean IT workers have already been documented by the FBI — a logical evolution of the business model toward even higher revenues per operator.

AI as a Double-Edged Weapon

Artificial intelligence is at the heart of this war. It enables North Korean agents to generate applications in bulk, simulate convincing interviews, create coherent fictitious identities, and defeat standard verification systems. But AI can also be the tool of defense: real-time deepfake detection, behavioral analysis of work patterns, IP address correlation, advanced biometric verification. The question is who develops these defensive tools fast enough, and who deploys them at the scale of hundreds of thousands of companies.

The Nisos report concludes that the best protection remains a combination of active friction in the hiring process, physical identity verification, and an organizational culture that treats remote hiring as a security risk, not just an HR matter. This isn't a revolution — it's an adjustment. But it is urgent.

The supreme irony is that North Korean agents are using the best tools American tech has to offer — LLMs, deepfakes, communication platforms — to infiltrate American tech companies. That's the paradox of an open innovation economy: the tools you create for the entire world can be turned against you. And when the state that turns them against you is also developing nuclear weapons, it's more than just an intellectual property issue.

What the Nisos Report Changes — and What It Doesn't

The Nisos report published in June 2026 is the most detailed X-ray ever published of a North Korean employment fraud operation. It documents figures, processes, a hierarchy, and tools. It allows companies, regulators, and governments to understand exactly what they're facing. That's not nothing — information is the first line of defense.

But an X-ray is not a treatment. The cell described by Nisos operated between late 2024 and late 2025. It generated 76 jobs at real companies, accessed real systems, transferred real salaries to Pyongyang. Since the report's publication, new cells — having drawn lessons from this cell's exposure — are almost certainly active. The silent economic war continues. It has no visible front. It has no formal declaration. And for now, it has no strategic response commensurate with its scale.

The West Must Name the Enemy to Fight It

We need to call this operation what it is: an organized economic attack by an enemy state against Western companies. This is not ordinary cybercrime. It is not a marginal phenomenon. It is a strategic funding line for a nuclear weapons program that threatens regional stability in the Asia-Pacific and, ultimately, global security. The West cannot continue treating this threat as an HR compliance problem. It must treat it for what it is: a component of hybrid warfare waged by Pyongyang against liberal democracies, with China and Russia serving as its geographic and diplomatic umbrella.

We long looked at North Korea as a geopolitical oddity, a grotesque and archaic regime surviving by inertia. The Nisos report forces us to revise that judgment. Pyongyang understood before we did that the next economic war would be fought on LinkedIn, inside startup HR processes, inside laptop farms in New Jersey. That is a form of strategic intelligence we would be wrong to underestimate — even if we're entirely justified in finding it deeply sinister.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.