New Research Exposes DPRK IT Workers’ Email Addresses and Recruitment Trends

New cybersecurity research has revealed important details about how DPRK-affiliated IT professionals, who fall under Microsoft’s “Jasper Sleet” threat actor group, operate. They take advantage of remote work opportunities in the Web3, blockchain, and cryptocurrency industries to obtain unauthorized access to company networks.

By securing legitimate employment, these actors bypass traditional initial access vectors like zero-day exploits or dark web purchases, directly infiltrating target organizations to siphon funds toward North Korean missile programs.

Sophisticated Infiltration Tactics

The analysis stems from two data leaks exposing approximately 1,417 email addresses, primarily sourced from platforms like GoFile and corroborated by overlaps with Operation Endgame 2.0, a Europol-led crackdown on malware networks in May 2025.

These emails, spanning 63 domains with Gmail dominating at 1,175 instances, highlight a preference for privacy-focused services such as Skiff, Proton, and temporary providers like AnonAddy and Gizmotik, enabling pseudonymity and evasion of detection.

The leaked datasets reveal distinct patterns in username construction, including birth years (e.g., 1990–1995) suggesting operatives aged 23–36, animal motifs like “dragon” (appearing in 14 addresses), Greek mythology references (e.g., Artemis, Athena), and tech-oriented terms (e.g., “dev”, “coder”).

Password analysis from associated breaches, such as CutOut Pro and infostealer logs like ALIEN TXTBASE, exposes weak credentials like “123qwe!@#QWE” and “asdasdasd”, often tied to QWERTY patterns, alongside outliers like “Xiah” repeated six times.

Many accounts feature 2FA via Google Authenticator and recovery emails linking within the dataset, indicating coordinated identity management.

Overlaps with breaches including Canva, Z-Lib, and Operation Endgame underscore these emails’ involvement in broader malicious activities, with evidence of infostealer compromises yielding plaintext passwords from non-Gmail services.

Defensive Recommendations

Further examination of the second leak, attributed to researcher ZachXBT, exposes operational workflows including weekly reports, expense spreadsheets for acquiring SSNs, Upwork/LinkedIn accounts, VPNs, and tools like Octo Browser, AnyDesk, and FaceSwap for remote interviews.

According to the report, Search histories indicate targeting of Poland-based firms, ERC20/Solana ecosystems, and AI companies, with cryptocurrency wallets like ETH address 0x78e1a4781d184e7ce6a124dd96e765e2bea96f2c linked to payments.

Pseudo-identities often mimic UK residents of Chinese origin, with Russian IP traces via Google Translate to Korean, reinforcing DPRK attribution.

GitHub profiles matching Microsoft’s Jasper Sleet reports and freelance platform activity on Upwork and Craigslist amplify the risk of espionage and supply chain compromise.

To mitigate these threats, organizations should integrate machine learning models trained on leaked email patterns for applicant screening, scrutinize connections to China or Russia during background checks, and deploy anti-deepfake tools like DeepFake Scanner for video interviews.

While these indicators aid early detection, threat actors’ adaptive modus operandi necessitates ongoing vigilance and data-driven verification protocols.

Indicators of Compromise (IOC)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!