Home › Threat Actors › DPRK IT Worker Networks (UNC5267 / Nickel Tapestry)
← All Threat Actors
Nation-State high North Korea (DPRK)

DPRK IT Worker Networks (UNC5267 / Nickel Tapestry)

North Korean state-directed (RGB — Reconnaissance General Bureau) · Revenue generation for DPRK regime via employment fraud / espionage via insider access / extortion post-infiltration

Reports 1
Active Since 2018
Last Reported 9 Jul 2026
Sectors Targeted finance, communications, healthcare

Tactics, Techniques & Procedures (TTPs)

  • Employment fraud at industrial scale: thousands of North Korean operatives posed as freelance developers and remote employees across global companies
  • Deepfake video and AI-generated profile photos for remote interview fraud — bypassing video verification entirely
  • Laptop farm networks: facilitators in the US, Europe, and Southeast Asia receive corporate laptops, connect them to DPRK-controlled infrastructure, and relay sessions to operators overseas
  • Post-infiltration escalation: once inside as an "employee," access is expanded to proprietary code, customer data, authentication systems, and cloud environments
  • Extortion upon discovery: operatives who detect they are being investigated threaten to publish stolen code or data unless paid
  • Legitimate project delivery maintained to avoid detection — operatives genuinely complete work assignments while conducting parallel espionage
  • Use of VPNs, multiple remote desktop hops, and cryptocurrency payment channels to obscure true location

Known Targets

Technology companies globally (SaaS, AI, cryptocurrency, defence tech)Financial services and fintech organisationsHealthcare technology companiesCompanies hiring remote developers without rigorous identity verificationAI and ML development organisations with access to proprietary model training data

Analyst Notes

The DPRK IT worker programme is the world's most successful state-run employment fraud operation, generating an estimated $250M–$600M annually for the regime. Thousands of operatives work across multiple simultaneous jobs, each appearing as an independent contractor. The operation has matured significantly since 2022: deepfake interview technology now bypasses video verification; extortion is now standard when operatives face exposure; and AI-specific targeting (access to LLM API keys, training datasets, and model weights) reflects Pyongyang's strategic interest in AI as both a capability and a revenue source. Multiple US DOJ indictments (2024) and Treasury OFAC sanctions have had limited operational impact as the programme operates from DPRK territory. Companies using remote developers without verified hardware controls, strong identity proofing, and behavioural monitoring represent ongoing exposure.

Also Known As

UNC5267 (Mandiant)Nickel Tapestry (Microsoft)Famous Chollima (CrowdStrike — partial overlap)

MITRE ATT&CK Techniques

T1586.002 Compromise Accounts: Email Accounts (fabricated personas) T1078 Valid Accounts (legitimate employee access) T1657 Financial Theft / Extortion T1213 Data from Information Repositories (proprietary code, customer data) T1090 Proxy (multi-hop remote desktop and VPN obfuscation)

Intelligence Reports

Analysis financecommunications

DPRK IT Worker Networks: North Korea's Industrial-Scale Employment Fraud Operation

North Korea is running an industrial-scale programme in which thousands of operatives pose as freelance software developers and remote employees to generate revenue, conduct espionage, and extort companies they infiltrate. Tracked as UNC5267 and Nickel Tapestry, this threat has graduated from a revenue scheme to a direct enterprise security risk.

9 Jul 2026 · 14 min read