Axios reports that North Korean remote IT worker operations have reached major U.S. companies, including Fortune 500 environments, as a sanctions-evasion revenue stream for Pyongyang. The scheme uses stolen or fabricated identities, AI-generated resumes and profiles, staffing platforms, practiced interviewers, U.S. laptop farms, remote desktop tools, China-based front companies, and cryptocurrency channels to obtain work and move salaries. The article links parts of the ecosystem to DPRK units and clusters including APT45, Lazarus Group, Research Center 227, Jasper Sleet, Moonstone Sleet, and Famous Chollima, while describing risks that include espionage, IP theft, extortion, and insider access. The reporting matters because it shows the activity is not limited to isolated hiring fraud but has become a distributed operational model involving technical, financial, and human facilitators.