saja-dprk-employment-scam-network.pdf (8 MB)

Nisos tracks the Saja DPRK Employment Scam Network as a likely DPRK-affiliated IT worker operation seeking remote engineering and full-stack blockchain roles. The actors posed as Polish and U.S. nationals through GitHub accounts, portfolio sites, freelancer profiles, and a freelance software development company called Inspiration With Digital Living. Nisos tied the cluster together through repeated lion-themed GitHub avatars, similar "century" email addresses, cloned portfolio templates, reused personas, and manipulated profile photos. The activity shows DPRK IT worker tradecraft extending beyond individual fake resumes into legitimate-looking developer companies built to win freelance and full-time remote work.