# INVESTIGATION: Kim Jong-un Had His Hackers Inside Your Offices — 167,000 Applications, 76 Jobs Obtained

> In 2024, a candidate for an AI architect position applied to Nisos, a cybersecurity firm based in Virginia. He stumbled through his answers, changed the subject when asked to share his screen, and claimed to live in Florida while his metadata placed him elsewhere. Nisos didn't reject him. Instead, the firm sent him a booby-trapped laptop, monitored every keystroke, and began ma

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Investigation
- Published: 2026-06-27
- Canonical URL: https://mad-max.co/en/article/enquete-kim-jong-un-avait-ses-hackers-dans-vos-bureaux-167-000-candidatures-76-e

## Introduction: A Ghost Cell at the Heart of American Tech Companies

### The Moment Everything Changed for Nisos

In **2024**, a candidate for an **AI architect** position applied to **Nisos**, a cybersecurity firm based in **Virginia**. He stumbled through his answers, changed the subject when asked to share his screen, and claimed to live in **Florida** while his metadata placed him elsewhere. Nisos didn't reject him. Instead, the firm sent him a booby-trapped laptop, monitored every keystroke, and began mapping what turned out to be one of the most sophisticated **employment fraud** operations ever documented against Western companies.

The report published on **June 16, 2026** is explosive: a **cell of 22 North Korean agents** submitted at least **166,893 applications**, secured **21,645 interviews** and obtained **76 real job offers** from American companies between **December 2024** and **September 2025**. This isn't conventional cyberwarfare. It's industrial infiltration disguised as job-seeking.

### A Network Structured Like a Business

The **Democratic People's Republic of Korea** leaves nothing to chance. According to Nisos, the cell operated with a formal hierarchy: **administrators**, **managers**, **team leaders**, **field operators**, and **American facilitators** — referred to as "**natives**" in internal communications — recruited on U.S. soil to physically participate in video interviews, manage employer-issued computers, handle drug screening tests, and facilitate administrative onboarding.

Internal communications flowed through **Discord**, **Telegram**, and **WhatsApp**. Agents used **three-letter initials** to protect their identities. Everything was conducted exclusively in **English** to avoid triggering foreign-language detection. **Performance dashboards** tracked application-to-interview-to-offer conversion rates, exactly like a **sales center**.

*There is something deeply unsettling about this image: agents of a totalitarian regime precisely mimicking the rituals of liberal capitalism — the dashboards, the quotas, the performance reviews — to infiltrate that very system from within. Pyongyang understood Silicon Valley's codes better than some Silicon Valley recruiters did.*

## The Numbers That Reveal the Scale of the Operation

### An Industrial Ratio: 7,586 Applications Per Operator

With **22 operators** identified, each was responsible on average for **7,586 applications**, **984 interviews**, and **3.5 job offers**. The application-to-interview conversion rate was **13%**, which is remarkably high for a large-scale fraud. The interview-to-offer conversion rate remained low — **0.35%** — but volume compensates for everything. These numbers are not the product of improvisation. This is **pure volume**, applied with factory-floor rigor.

The roles targeted were heavily concentrated in **software development**, **engineering**, and **data** — more than **70%** of positions pursued. Targeted salaries ranged from **$55,000** to **$230,000** per year. The technology sector accounted for **42.6%** of offers obtained, followed by **consulting**, **healthcare**, and **financial services**. The reason is simple: tech roles offer high salaries, a well-established **remote work** culture, and an often inadequate vetting process.

### Two Convicted American Facilitators

In **May 2026**, the **U.S. Department of Justice** convicted two American citizens for their roles in separate but similar operations. **Matthew Isaac Knoot**, of **Nashville**, and **Erick Ntekereze Prince**, of **New York**, were each sentenced to **18 months in prison**. Together, their operations had generated more than **$1.2 million** for the North Korean regime and compromised nearly **70 victim companies** across the United States.

These convictions illustrate a central element of the system: without **local facilitators**, the operation doesn't function nearly as well. North Korean agents need Americans to receive laptops, appear at video interviews, and complete physical testing. This isn't science fiction — it's a human supply chain for fraud.

*The conviction of Knoot and Prince is symbolically important, but it changes little about the scale of the problem. Two people behind bars against an operation that produced 76 jobs obtained and which, according to CrowdStrike, doubled its volume of attacks in 2025. The balance of power remains absurdly lopsided.*

## The Tools: AI, Deepfakes, and Laptop Farms

### Artificial Intelligence in Service of Pyongyang

North Korean operators didn't rely solely on their own interview skills. They used **accent training tools** to mask their linguistic origins, **remote access technologies** to control computers from abroad — presumably from **China** or **Russia** — and **AI-powered deepfakes** during video interviews to present a convincing American face. According to Nisos, the infrastructure also included **identity brokers**, networks for buying and selling stolen identities of real Americans.

The **laptop farm** is the physical element that reveals the full ingenuity of the system. Companies ship their corporate equipment to a U.S. address — that of a paid facilitator. The facilitator connects the computer to the internet and allows the North Korean operator, thousands of miles away, to access it remotely. For the company, the geolocation is perfect. For authorities, it is nearly undetectable without targeted surveillance.

### Operational Infrastructure Worthy of a Small Business

Nisos describes a **Discord** infrastructure organized into distinct channels: an **applications** channel, a **training** channel, an **identity management** channel, a **performance** channel. Agents received precise instructions on what questions to anticipate, what answers to prepare, and what software to master for common tech roles. This level of organization far exceeds what one would expect from an improvised criminal operation. It's a **structured fraud enterprise** with internal HR processes.

Payments to American facilitators were routed through **ERC20 cryptocurrencies** — traceable in theory, but difficult to follow in practice when wallets are multiplied and mixed. The ultimate goal is always the same: **circumvent international sanctions** and fund **Kim Jong-un**'s weapons program, in particular the development of **ballistic missiles** and **nuclear weapons**.

*What strikes me most is that these operations target precisely the most open, most progressive, most trusting sectors of the American economy — tech startups, scale-ups, data firms. These aren't defense companies with strict protocols. They're teams that hire fast, remotely, on the strength of a résumé and a Zoom call. Pyongyang identified their Achilles heel with surgical precision.*

## Context: A Program That Has Industrialized Since 2020

### From a Few Hundred to Thousands of Active Operators

The Nisos report documents a **specific cell**, but the phenomenon is far broader. According to the **United Nations**, North Korean IT workers generate between **$250 million and $600 million per year** for the regime, active in more than **40 countries**. South Korea's **National Intelligence Service** reported that Pyongyang's cyber division grew from **6,800 agents** in 2022 to **8,400** in 2024. **CrowdStrike** identified **45 distinct operations** linked to North Korean IT workers in **March 2026** alone — up from 33 in March 2025. The acceleration is massive.

The law firm **Skadden** published an analysis in **June 2026** detailing the legal risks for companies that inadvertently hire these agents: potential **sanctions** violations, **cybersecurity** risks, criminal liability, and reputational damage. More than **40 individuals** have been indicted by the DOJ in these operations, including American citizens, Chinese nationals, and Taiwanese nationals.

### Operation Famous Chollima — The Name the Industry Won't Forget

**CrowdStrike** designates the operation under the name **Famous Chollima** — a reference to the winged horse of Korean mythology, a symbol of speed and power. The name is well chosen: the operation moves fast, very fast, and strikes everywhere at once. In **2025**, the volume of attacks **doubled** compared to the previous year. The DOJ announced in **June 2025** nationally coordinated actions including raids on **29 laptop farms** across **16 states**, the seizure of **29 financial accounts**, and **21 fraudulent websites**.

These operations are far from anecdotal. Some North Korean operators access sensitive systems, intellectual property data, and source code infrastructure. These are not merely salary scams — they are **data theft vectors** and potentially long-term **sabotage** tools for a regime that considers the West its principal enemy.

*North Korea has been waging unconventional economic warfare for years, and the West still has no systemic response. We punish two Americans here, raid a few laptop farms there. Meanwhile, 22 agents from a single cell submitted 167,000 applications and landed 76 jobs. This isn't a war you win with one-off actions.*

## Victim Companies: How Did They Let This Slip Through

### Remote Hiring Culture as a Blind Spot

The **COVID-19** pandemic normalized **remote work** at a speed that security departments couldn't keep pace with. In **2020**, tech companies massively adopted fully online hiring processes: résumés, video interviews, digital onboarding. For an operation like Famous Chollima, this was ideal terrain. There's never a handshake, never a photo badge, never a physical identity check. Just a convincing **LinkedIn** profile, a solid résumé, and an agent trained to ace technical interviews.

The warning signs documented by the **FBI** and **Nisos** are clear: refusal to appear on unplanned video, a background that never changes, requests for a specific laptop hosting service, inconsistencies in identity information, multiple workers connecting from the same IP address. These markers are known. But at a startup hiring 20 developers a month, who has the time to verify them all with this level of scrutiny?

### The Financial Sector in the Crosshairs for 2026

According to **Fortune** and **CrowdStrike**, North Korean adversaries have become in **2026** the **primary nation-state intrusion threat** for companies in the American financial sector. Financial services firms, consumer banks, and their service providers are now in the crosshairs — far more sensitive targets than tech startups. **Access to banking systems** via infiltrated employees would represent a major qualitative leap for Pyongyang's illicit financing program.

The **Nisos report of June 2026** may be the most detailed warning ever published on this type of operation. But the fact that it required Nisos to **deliberately accept** a suspicious agent, send him a booby-trapped laptop, and monitor his activities for months to obtain this data says everything about the difficulty of passive detection. Ordinary companies have neither the resources nor the counterintelligence culture to run this type of operation.

*One could simplify the problem this way: American companies built their hiring processes to find the world's best engineers, not to detect agents of an enemy state. That's not a criticism — it's an observation. But the world has changed, and hiring protocols must change with it.*

## The Institutional Response: Between Targeted Prosecutions and a Lack of Systemic Framework

### The DOJ Is Accelerating but It Isn't Enough

The **Department of Justice** has ramped up actions since **2024**: indictments of North Korean, Chinese, and Taiwanese nationals, convictions of American facilitators, seizures of accounts and computer equipment. But these actions remain **reactive**: they intervene after operations have run for months or years. And for every cell exposed, how many others are quietly operating inside companies that didn't have Nisos's luck or instincts?

The **FBI** now offers a reward of **$5 million** for any information leading to the arrest of members of these networks. The **FBI, State, and Treasury** agencies have published joint advisories detailing red flags. But the tech startup ecosystem — with its hundreds of thousands of companies, decentralized hiring processes, and default-trust culture — is structurally difficult to protect through government advisories.

### What Companies Can Concretely Do

The recommendations from **Skadden** and **Nisos** converge: require at least **one physical verification** before hiring, use **deepfake detection** tools during video interviews, ship computer equipment only to the address on **official identity documents**, tie corporate access to **verified physical devices**, analyze **connection patternsinternal reporting** systems. These measures are not technically complex. They mainly require an **organizational will** to take the risk seriously.

The real question is one of **collective responsibility**. Companies that inadvertently hire North Korean agents are not criminals — but they are objectively funding a weapons program that threatens regional and global security. There is a moral and strategic obligation to treat this risk with the same rigor as any other compliance or cybersecurity risk.

*I have no illusions about the priorities of a hypergrowth startup. When you're hiring 10 developers a month and have an 18-month runway, counterintelligence vetting isn't at the top of your list. But if 76 jobs were obtained by a single cell, and the UN estimates the annual revenues of this program at between $250 million and $600 million, we need to call it what it is: a tax imposed by Pyongyang on the Western tech economy.*

## The Geopolitics Behind the Scheme: Sanctions, Missiles, and Regime Survival

### A Program Indispensable for Funding Kim Jong-un

**North Korea** lives under one of the most severe **international sanctions** regimes in the world since the acceleration of its nuclear program. Legitimate exports are virtually nonexistent. The country depends on a combination of trafficking, cybercrime, and fraudulent employment operations to fund both the government and its weapons development. The remote IT worker program has become one of the most profitable and hardest-to-detect revenue streams.

The link between fraudulent salaries and **intercontinental ballistic missiles** is direct and documented. In **2026**, **Kim Jong-un** personally visited a weapons production plant and called for **multiplying missile production capacity by 2.5**. He also inaugurated a new **nuclear materials factory**. This is no coincidence: revenues from cyberespionage and employment fraud directly feed these programs. The American tech companies that hired an agent from the Nisos cell were, unknowingly, contributing to this acceleration.

### A Challenge to the International Order

This type of operation raises a fundamental question for the **international order**: how do you contain a state determined to circumvent all sanctions when its primary circumvention tool is indistinguishable from a normal employee? **China** and **Russia** host a large proportion of these operators — without the cooperation of both countries, any American judicial action remains structurally limited.

The **international community** is discussing information-sharing mechanisms between companies, between governments, and between sectors. But North Korea has a head start: it improves its tools and processes **faster** than regulators can document them. The Nisos report of June 2026 describes an operation that ran between late 2024 and late 2025. Meanwhile, new cells — with lessons learned from that cell's exposure, with new protocols, new AI tools, new identities — are almost certainly already at work.

*What I observe is an asymmetric war that the West hasn't yet formally declared. North Korea infiltrates our companies, steals our salaries, funds its bombs — and our primary response consists of sentencing two facilitators to 18 months in prison and publishing security advisories. We need to name the thing: this is an attack on our economy, carried out by an enemy state, and it demands a strategic response, not just sporadic prosecutions.*

## The Next Phase: Toward More Sensitive Targets

### From Tech Startups to Financial Institutions

The evolution documented by **CrowdStrike** is concerning: in **2025**, the Famous Chollima operation not only doubled its volume, it also broadened its targets. Banks, insurance companies, fintechs, and asset managers are now explicitly in scope. An agent embedded in a financial institution has access to far more valuable data — payment systems, customer databases, SWIFT infrastructure, transaction data. The qualitative leap is considerable.

It is also likely that these operations will evolve toward **extortion**: an agent already in a position, with access to sensitive data, could threaten to leak it if their identity is about to be discovered. Cases of **extortion by former North Korean IT workers** have already been documented by the **FBI** — a logical evolution of the business model toward even higher revenues per operator.

### AI as a Double-Edged Weapon

**Artificial intelligence** is at the heart of this war. It enables North Korean agents to generate applications in bulk, simulate convincing interviews, create coherent fictitious identities, and defeat standard verification systems. But AI can also be the tool of defense: real-time **deepfake** detection, behavioral analysis of work patterns, IP address correlation, advanced biometric verification. The question is who develops these defensive tools fast enough, and who deploys them at the scale of hundreds of thousands of companies.

The **Nisos** report concludes that the best protection remains a combination of **active friction** in the hiring process, **physical identity verification**, and an organizational culture that treats remote hiring as a security risk, not just an HR matter. This isn't a revolution — it's an adjustment. But it is urgent.

*The supreme irony is that North Korean agents are using the best tools American tech has to offer — LLMs, deepfakes, communication platforms — to infiltrate American tech companies. That's the paradox of an open innovation economy: the tools you create for the entire world can be turned against you. And when the state that turns them against you is also developing nuclear weapons, it's more than just an intellectual property issue.*

## Conclusion: A Silent Economic War with No Visible Front

### What the Nisos Report Changes — and What It Doesn't

The **Nisos** report published in **June 2026** is the most detailed X-ray ever published of a North Korean employment fraud operation. It documents figures, processes, a hierarchy, and tools. It allows companies, regulators, and governments to understand exactly what they're facing. That's not nothing — information is the first line of defense.

But an X-ray is not a treatment. The cell described by Nisos operated between late **2024** and late **2025**. It generated **76 jobs** at real companies, accessed real systems, transferred real salaries to **Pyongyang**. Since the report's publication, new cells — having drawn lessons from this cell's exposure — are almost certainly active. The silent economic war continues. It has no visible front. It has no formal declaration. And for now, it has no strategic response commensurate with its scale.

### The West Must Name the Enemy to Fight It

We need to call this operation what it is: an **organized economic attack by an enemy state** against Western companies. This is not ordinary cybercrime. It is not a marginal phenomenon. It is a **strategic funding line** for a nuclear weapons program that threatens regional stability in the **Asia-Pacific** and, ultimately, global security. The West cannot continue treating this threat as an HR compliance problem. It must treat it for what it is: a component of **hybrid warfare** waged by **Pyongyang** against liberal democracies, with **China** and **Russia** serving as its geographic and diplomatic umbrella.

*We long looked at North Korea as a geopolitical oddity, a grotesque and archaic regime surviving by inertia. The Nisos report forces us to revise that judgment. Pyongyang understood before we did that the next economic war would be fought on LinkedIn, inside startup HR processes, inside laptop farms in New Jersey. That is a form of strategic intelligence we would be wrong to underestimate — even if we're entirely justified in finding it deeply sinister.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Nisos — Report: DPRK cell, 166,893 applications, 76 job offers — June 16, 2026](https://www.prnewswire.com/news-releases/nisos-exposes-north-korean-cell-behind-167-000-fake-job-applications-to-us-companies-302801315.html)

- [Nisos — Internal analysis: operational structure of North Korean employment fraud — June 18, 2026](https://nisos.com/blog/inside-dprk-employment-fraud-operation/)

- [DOJ — Sentencing of Knoot and Prince, 18 months in prison, $1.2M for Pyongyang — May 6, 2026](https://www.justice.gov/opa/pr/two-us-nationals-sentenced-facilitating-fraudulent-remote-information-technology-worker-0)

- [Skadden — Managing legal risks related to North Korean remote IT workers — June 8, 2026](https://www.skadden.com/insights/publications/2026/06/north-korean-remote-it)

### Secondary sources

- [Fortune / CrowdStrike — North Korea: primary threat to financial sector in 2026 — May 14, 2026](https://fortune.com/2026/05/14/north-korea-it-workers-stealing-billions-financial-firms-next-target-crowdstrike/)

- [NK News — How the DPRK cell built a 167,000-application machine — June 18, 2026](https://www.nknews.org/pro/how-a-north-korean-it-worker-cell-built-a-167k-job-application-machine/)

- [TechStreet Now — Analysis of the Nisos operation: 22 agents, AI and deepfakes — June 18, 2026](https://thetechstreetnow.com/these-actors-are-no-longer-relying-solely-on-traditional-cybercrime-experts-uncover-another-massive-north/)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/enquete-kim-jong-un-avait-ses-hackers-dans-vos-bureaux-167-000-candidatures-76-e