dprk-it-threat-japan.pdf (4 MB)

Nisos traced a likely DPRK IT worker who appears to have used multiple personas to obtain remote software engineering and full stack developer roles with Japanese companies. The investigation pivoted from an email address cited in a UN sanctions report to GitHub activity, resumes, freelance profiles, and work-history artifacts tied to the AnacondaDev0120 identity. The case shows how DPRK workers can reuse developer accounts, fake names, and online employment platforms to generate revenue while hiding sanctions risk from employers.