Sophos profiles NICKEL TAPESTRY as a North Korea-linked fraudulent IT worker activity set, aligned with names such as DPRK IT Workers, Famous Chollima, Jasper Sleet, Purpledelta, Storm-0287, UNC5267, and Wagemole. The activity comprises multiple clusters operated on behalf of North Korean interests and focuses on infiltrating Western companies for illicit revenue generation. The profile also warns that these workers can create insider-threat risk, including observed theft of intellectual property. It connects the activity to U.S. government advisories describing revenue generation for illicit weapons programs, including weapons of mass destruction.