Nisos identified online personas probably used by DPRK IT workers to obtain remote employment at U.S. companies while posing as non North Korean teleworkers. The personas advertised web, mobile, programming, crypto, and blockchain skills, appeared on employment and freelance platforms, and often lacked normal social media footprints. Investigators found repeated photos across different names and locations, copied resume material from real IT professionals, and accounts that disappeared quickly after job applications or fraud flags. The report frames the activity as sanctions risk and potential IP exposure because DPRK IT worker revenue supports regime priorities.