38 North examines how DPRK IT workers obtain remote jobs under fabricated or stolen identities to generate revenue and create insider-risk exposure for global employers. The report describes facilitators who supply false documents, procure laptops, run laptop farms, set up remote access infrastructure, and help workers bypass hiring controls. It highlights exploitation of freelance platforms, front companies, VPNs, doctored identity documents, pre-verified accounts, and generative AI-assisted interview preparation. Targeted or exposed sectors include software development, gaming, fintech, cryptocurrency, Web3, and other remote-first technology environments with inconsistent identity verification. The report frames DPRK IT worker activity as a systemic recruitment-integrity and sanctions-risk problem rather than only a traditional intrusion campaign.