When a suspected North Korean operative applied for a remote AI engineering position at human-risk management firm Nisos in June 2025, the company decided to run its own operation on the fraudster. Nisos notified law enforcement, conducted an HR interview, "hired" the worker, and sent a laptop to that person's US address in Florida — a laptop "farm" — with surveillance implants.
"When they opened the laptop, we could see that [the computer was] in a closet with a bunch of other companies' computers," says Ryan LaSalle, the firm's CEO. "We could see it so well that we could see the names of the other companies on the screens across the closet."
Over the following months, Nisos' team monitored the operator as he used Gmail to apply to other jobs, logged into Discord to chat with other operators — 22 in total — and worked with four different facilitators in the US, all while connecting from a location on the border of North Korea and China.
Last week, law enforcement and security agencies from the US, Japan, Australia, and Germany released an updated advisory informing companies of the risks posed by fake IT worker operations coming from the Democratic People's Republic of Korea (DPRK). Dubbed WaterPlum — or Contagious Interview by other threat-intelligence firms — the threat actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets, according to the advisory. Their goal: embed themselves in companies worldwide to provide a stable source of income for the North Korean regime.
Five years ago, the operations were relatively unknown, and the IT worker campaigns had significant success. The reliance of many companies on remote workers — especially in the IT sector — and the increasing capabilities of AI have made the efforts more pervasive.
But today, human-resource groups should have the tools and the processes to detect suspicious applicants and escalate efforts to determine whether they pose a risk to the company. From the use of voice-over-IP (VoIP) for calls to a lack of a digital footprint, there are a variety of signs that can indicate a risky applicant and help companies detect them early, says Nicholas Kowalczyk, vice president and chief risk, compliance, and privacy officer for Kelly Services, a staffing and workforce solutions company.
"There's probably not any one silver bullet here," he says. "It's stacking enough pieces within the recruiting process itself where it's a hurdle to the people who are potential bad actors, but not enough of a hurdle to the good candidates."