TLDR: North Korean state-sponsored hacking groups are extensively using artificial intelligence to create fake identities, secure remote IT jobs, and infiltrate over 320 Western companies. This sophisticated scheme, detailed in recent reports by cybersecurity firms like CrowdStrike and Google Cloud, aims to bypass international sanctions and fund the regime’s weapons programs, including its nuclear missile development. The operatives leverage generative AI for everything from crafting resumes and deepfaking appearances in interviews to assisting with daily coding tasks and translations, marking a significant escalation in their cyber warfare tactics.
Recent intelligence from leading cybersecurity firms reveals a dramatic surge in North Korean state-sponsored cyberattacks, with operatives leveraging artificial intelligence (AI) to infiltrate over 320 Western companies through elaborate fake job schemes. This represents a staggering 220% increase in such incidents over the past 12 months, according to a ‘2025 Threat Hunting Report’ released by U.S.-based cybersecurity giant CrowdStrike on August 4, 2025. The primary objective of these sophisticated operations is to evade international sanctions and generate illicit revenue to fund North Korea’s weapons programs, including its nuclear missile development.
The scheme involves North Korean actors, often associated with groups like ‘Famous Chollima’ (CrowdStrike) and ‘UNC4899’ (Google Cloud), creating false identities, resumes, and work histories, predominantly generated by artificial intelligence. These operatives then apply for remote software development positions at Western companies. A critical component of their success lies in their adept use of generative AI (GenAI) tools, which automate and optimize workflows at every stage of the hiring and employment process.
During the hiring phase, AI is reportedly used to draft convincing resumes and even to modify or ‘deepfake’ their appearance during remote video interviews, masking the true identity and location of the applicants. Many of these operatives are not fluent in English, making AI-powered translation tools indispensable for communication during interviews and daily tasks. Once hired, these fake employees continue to rely on GenAI code assistants, such as Microsoft Copilot or VSCodium, and translation tools to perform their legitimate job functions and manage multiple streams of communication, often while simultaneously working three or four jobs.
Google Cloud’s H2 2025 Cloud Threat Horizons Report also highlighted similar activities, with its ‘Google Threat Intelligence Group’ actively tracking UNC4899. This group successfully hacked two companies by contacting employees via social media under the guise of freelance software development opportunities. The attackers convinced employees to download malware, establishing connections to hacker-controlled command-and-control infrastructures and gaining access to cloud-based systems. They then conducted internal reconnaissance, obtained credential materials, and pivoted to cloud environments, ultimately transferring millions worth of cryptocurrency from company accounts.
Cybersecurity firm Wiz, which also reported on the UNC4899 hacks, categorizes this activity under the U.S. government’s ‘TraderTraitor’ cluster. The U.S. Treasury has confirmed that North Korea-backed entities behind TraderTraitor include notorious groups like Lazarus Group, APT38, BlueNoroff, and Stardust Chollima. The Lazarus Group, for instance, was responsible for the record-breaking $1.4 billion Ethereum theft from digital asset exchange Bybit in February 2025.
Beyond financial gain, these attacks may also pursue strategic espionage objectives, seeking sensitive cryptocurrency intellectual property and technology. Once employed, the operatives can also leverage their access and credentials to exfiltrate sensitive company data, using publicly available AI models to aid in reconnaissance, vulnerability research, and the development of phishing campaign content.
Also Read:
- Walmart Leverages Advanced AI to Bolster Global Security Infrastructure
- South Korea’s Ministry of Foreign Affairs to Launch Generative AI System ‘MOFAI’ in November
In response to these escalating threats, CrowdStrike has recommended enhanced identity verification processes during hiring, including rigorous background investigations and corroboration of online professional profiles. They also suggest implementing real-time deepfake challenges during interviews or employment assessment sessions and providing training programs for hiring managers and IT personnel to recognize potential insider threats utilizing AI tools.
