Leaked data reviewed by WIRED and researcher SttyK exposes the internal workflow of an alleged North Korean IT-worker operation that tracks job applications, fake identities, hardware, earnings, and team budgets across Google, GitHub, Slack, and spreadsheet records. The material shows workers pursuing remote roles in areas such as AI, blockchain, web scraping, bot development, mobile and web development, trading, CMS work, and desktop applications while relying heavily on US-based technology platforms. Screenshots reportedly show about 12 groups with roughly a dozen members each, a master boss, daily job-status tracking, device inventories, fake IDs, cover-letter templates, laptop-farm details, and account-creation manuals. The reporting connects the activity to DPRK revenue generation, noting UN estimates of hundreds of millions of dollars annually and references to entities such as Kim Chaek University of Technology and Korea Ryonbong General Corporation.