Mandiant describes UNC5267, a DPRK IT worker operation in which North Korean personnel use stolen or fabricated identities to obtain remote jobs, especially in Western technology companies. Facilitators help the workers launder money or cryptocurrency, receive and host company laptops, support employment verification, and maintain access to financial systems. The report links the activity to sanctions evasion and revenue generation for North Korea, and notes that fraudulent workers can gain elevated access to code and network administration even when they initially operate within their job duties. Observed tradecraft includes front companies, mismatched laptop shipping and identity locations, multiple simultaneous jobs, fake resumes, and hosted developer profiles built from stolen professional images.