Worked example · 2018-20

DPRK IT worker exchange account farming — 2018–2025

Loss

Infrastructure case, not a per-victim loss. DPRK IT workers, operating under the OAK-G04 (DPRK IT Worker Scheme) actor designation, have used fabricated and stolen identities to obtain remote-work employment at cryptocurrency exchanges, DeFi protocols, and technology companies. The employment provides internal-system access and a salary that is paid to the regime. The sources cited here put one DOJ-charged slice of the scheme at at least $88 million over six years (December 2024 indictment of 14 DPRK nationals); no aggregate across all employers is sourced.

OAK Techniques observed

OAK-T8.004 (Exchange Account Farming / Sybil Accounts) — carried over from the earlier draft. The cited sources document false, stolen and borrowed identities used to get remote jobs; they do not document exchange-account creation or exchange KYC evasion, so this mapping is weak. OAK-T15.001 (Social Engineering of Operator Personnel) — the fake-recruiter and fake-applicant social-engineering chain that positions IT workers inside targeted organizations. OAK-T11.001 (Third-Party Signing Vendor Compromise) — once employed, IT workers with access to exchange infrastructure or hot-wallet signing systems become an internal T11.001 threat.

OAK-Gnn

OAK-G01 Lazarus Group / DPRK-attributed.

Attribution

confirmed — the US Department of Justice has indicted DPRK nationals (14 charged in December 2024, working for DPRK-controlled firms Yanbian Silverstar and Volasys Silver Star) and US-based facilitators; the State Department offers rewards of up to $5 million (The Hacker News, SecurityWeek).

Corrected 2026-10-11

removed the unsourced "hundreds of millions" aggregate, the "since ~2018" start, forged-passport / AI-photo specifics, the claim that workers create exchange accounts, and the named threat-intel vendors; added DOJ-sourced figures. Technique mapping (T8.004) fits poorly; see the report note.

Key teaching point

The DPRK IT worker scheme is an insider-access pattern: a fabricated or borrowed identity passes a hiring process, and the employment relationship itself provides access, salary and, in some cases, a route to theft or extortion. The T8.004 "employment-as-account-farming" framing from the earlier draft is not supported by the cited sources.