Insights into Suspected DPRK Workers

What it is

Huntress's forensic writeup of five suspected DPRK ("FAMOUS CHOLLIMA") remote workers found inside partner organizations in 2026. The summary names the roles and infrastructure; this page carries the specific detection signals an investigator can pivot on, plus the concrete tells that exposed forged identity documents.

How it works

DPRK workers are not intruders — they are hired, onboarded, and often do the real job. Detection therefore relies on behavioral and infrastructure correlation, not breach indicators. Huntress worked from an Australian healthcare partner's tip and pulled six months of Microsoft 365 Unified Audit Logs (Exchange, SharePoint, sign-ins) plus Huntress ITDR authentications, profiling IPs, ASNs, and geographic access patterns.

Preconditions / Affected

Any organization hiring remote staff, in any role — the page stresses expansion beyond IT into sales/marketing and healthcare. Relevant if you have M365 audit logging retained (they used six months) and can review OneDrive contents and sign-in infrastructure.

What to do

Concrete indicators the page provides for hunting:

• Infrastructure: authentications from Astrill VPN nodes, IPRoyal Proxy, and WorkTitans B.V. bulletproof hosting (reportedly raided by the Dutch FIOD). Heavy VPN/proxy use across an account that deviates from normal end-user behavior.
• Timing profile: less than 50% of activity during expected business hours; peak activity at exactly midnight UTC — which is 9am in North Korea. This is the strongest tell, since VPN use alone produces false positives.
• Identity-document forensics: inspect onboarding docs in OneDrive. Red flags Huntress found across two workers' documents: identical photography angle; passports issued in the same city (Shenzhen) one day apart; resident ID cards valid for identical periods and issued by the same authority (Songgang Police Station); all documents issued within two weeks of each other and within the month of investigation; both individuals listed on the same street; and electricity bills with matching typos and layout.
• Photo check: one worker used a photo stolen from a legitimate GitHub account with the face altered — reverse-image and consistency checks on profile/onboarding photos are worthwhile.

The operating pattern: verify identity through corroboration (timing + infrastructure + document cross-comparison), not a single signal.

flowchart TD
  A[Remote hire] --> B{VPN/proxy use?}
  B -->|Astrill / IPRoyal / WorkTitans| C{Activity timing}
  B -->|No| X[Likely legitimate]
  C -->|Peaks midnight UTC = 9am DPRK| D{Onboarding docs}
  C -->|Business hours| X
  D -->|Shared naming, matching issue details, typos| E[Suspected DPRK worker]

Caveats

The page states explicitly that VPN use alone is not a reliable indicator and often yields false positives — hence the need to corroborate with timing and document analysis. Midnight-UTC peak also overlaps legitimate Australian and Chinese business hours, so it is corroborating, not conclusive. All conclusions are "likely"/"suspected," reflecting attribution uncertainty. The fetched text is truncated mid-sentence, so the electricity-bill comparison detail is incomplete.