dprk-it-worker-scam-mitigation.pdf (3 MB)

Nisos tracks likely DPRK-affiliated IT workers posing as Singaporean, Turkish, Finnish, and US nationals to obtain remote engineering and blockchain jobs. The report identifies reusable persona infrastructure, including GitHub portfolios, resumes, contact details, and stock or manipulated profile photos, with examples such as Karl Chong, Roman Kryveha, Ram Maharjan, and John Alexander Bird. Nisos recommends OSINT-heavy hiring checks: reverse image searches, shared phone and email correlation, GitHub and portfolio review, location consistency checks, prior employment and education verification, reference retention, and on-camera or in-person interviews.