Leaked spreadsheets, Slack messages, and files linked to an alleged group of North Korean IT scammers show how they track potential jobs and record earnings
A new cache of data—emails, spreadsheets, Slack messages—reveals how meticulously they plan and track job applications, earnings, and day-to-day work life X: Dino A. Dai Zovi / @dinodaizovi : Maybe we should be talking more about how many companies seemingly don't do *any* reference checks on new hires? Forums: r/TrueReddit : Leak Reveals the Workaday Lives of North Korean IT Scammers
Context & Ripple Effects
This cache adds operational detail to a long-running pattern: US authorities previously said North Korean remote IT workers used false identities to obtain US jobs, while reporting has documented the domestic infrastructure that can support that access, including a US-based laptop farm serving DPRK workers.
The significance is evidentiary rather than merely anecdotal. Records of applications, pay, and work routines can help distinguish a coordinated employment operation from isolated resume fraud, extending concerns already raised when crypto firms unknowingly hired workers using fake identities.
First-order effects
- The leak gives employers, recruiters, and security teams concrete operational artifacts—job-tracking formats, earnings records, and workplace communications—to compare against their own hiring and access investigations.
- For the alleged group, the exposed records may make its methods and potential links among identities, applications, and compensation easier for investigators to map.
Second-order effects
- Companies with distributed engineering hiring are likely to put more weight on identity, reference, and device-location checks, increasing friction for legitimate remote candidates as well as suspicious ones.
- Intermediaries that enable remote work—staffing firms, payroll providers, and device-hosting arrangements—face greater pressure to detect mismatches between a worker's stated identity and their working setup.
Third-order effects
- If repeated leaks keep showing coordinated, process-driven operations, remote-work security will shift from screening individual applicants toward continuously validating identity and work context after hiring.
- The broader risk is a more fragmented global remote-labor market, where firms add controls around access and payment to manage sanctions, fraud, and insider-risk exposure.
The trend: This is part of the shift from treating remote hiring as a recruiting workflow to treating it as an ongoing identity-and-access security boundary.