{"id":5142,"date":"2025-07-02T08:36:14","date_gmt":"2025-07-02T08:36:14","guid":{"rendered":"https:\/\/friscotimes.org\/?p=5142"},"modified":"2025-07-04T06:44:08","modified_gmt":"2025-07-04T06:44:08","slug":"north-korean-operative-reveals-the-inner-workings-of-the-it-scam","status":"publish","type":"post","link":"https:\/\/friscotimes.org\/?p=5142","title":{"rendered":"North Korean operative reveals the inner workings of the IT scam"},"content":{"rendered":"\n<p>For years, Kim Ji-min served as an IT worker inside a <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote\" class=\"sc-19cc8fd2-0 iHosVH\">vast global scheme<\/a> devised by North Korea\u2019s authoritarian leadership to <a href=\"https:\/\/reports.dtexsystems.com\/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf?_gl=1*16ngf3n*_gcl_aw*R0NMLjE3NDY0NzEwMjQuQ2owS0NRand0OHpBQmhES0FSSXNBSFh1RDdaT1FkeS1SWTRXbDZVZHU4a2JCZHpVR0stNmlLRy1Lakh1Y3RnbkJYREdCQ2ZnamNtbGlfZ2FBakUxRUFMd193Y0I.*_gcl_au*OTYxMjM2ODE2LjE3NDQwNjkwNzE.\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/reports.dtexsystems.com\/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf?_gl=1*16ngf3n*_gcl_aw*R0NMLjE3NDY0NzEwMjQuQ2owS0NRand0OHpBQmhES0FSSXNBSFh1RDdaT1FkeS1SWTRXbDZVZHU4a2JCZHpVR0stNmlLRy1Lakh1Y3RnbkJYREdCQ2ZnamNtbGlfZ2FBakUxRUFMd193Y0I.*_gcl_au*OTYxMjM2ODE2LjE3NDQwNjkwNzE.\" class=\"sc-19cc8fd2-0 iHosVH\">evade<\/a> crushing <a href=\"https:\/\/www.ic3.gov\/PSA\/2025\/PSA250123\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.ic3.gov\/PSA\/2025\/PSA250123\" class=\"sc-19cc8fd2-0 iHosVH\">financial sanctions<\/a>. Kim has since defected to South Korea. Now, he is sharing his experience as a cog in the IT worker conspiracy employed by the Democratic People\u2019s Republic of Korea to amass billions to fund its <a href=\"https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf\" class=\"sc-19cc8fd2-0 iHosVH\">weapons of mass destruction program<\/a>.\u00a0<\/p>\n<div>\n<p>The North Korean IT worker scheme has become one of the most urgent cybersecurity issues among global Fortune 500 businesses. Hundreds of companies have unknowingly hired thousands of North Korean IT workers in recent years, giving them access to personal information and intellectual property and paving the way for U.S. dollars to be used as a funding source for DPRK authoritarian ruler Kim Jong Un\u2019s nuclear ambitions. U.S. authorities are publicizing the issue with joint warnings from the <a href=\"https:\/\/www.fbi.gov\/wanted\/cyber\/fraudulent-remote-it-workers-from-dprk\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.fbi.gov\/wanted\/cyber\/fraudulent-remote-it-workers-from-dprk\" class=\"sc-19cc8fd2-0 iHosVH\">FBI<\/a> and <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote\" class=\"sc-19cc8fd2-0 iHosVH\">Department of Justice<\/a>, alongside top cyber experts who have chosen to <a href=\"https:\/\/www.dtexsystems.com\/blog\/exposing-dprks-cyber-underworld\/\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.dtexsystems.com\/blog\/exposing-dprks-cyber-underworld\/\" class=\"sc-19cc8fd2-0 iHosVH\">speak out<\/a> about the threat.\u00a0<\/p>\n<p>U.S. Attorney for the Northern District of Georgia Theodore S. Hertzberg told <em>Fortune<\/em> the office announced charges against <a href=\"https:\/\/prod-i.a.dj.com\/public\/resources\/documents\/KimKwangJinIndictment.pdf\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/prod-i.a.dj.com\/public\/resources\/documents\/KimKwangJinIndictment.pdf\" class=\"sc-19cc8fd2-0 iHosVH\">four North Korean IT workers<\/a> this week as part of an orchestrated publicity campaign to encourage business and tech leaders to better understand the threat they\u2019re facing.\u00a0<\/p>\n<p>\u201cIt is not uncommon for business owners to meet potential partners and employees online,\u201d said Hertzberg in a statement. \u201cBut companies that work in this space would be wise to hire Americans and to thoroughly vet all potential employees and partners, preferably in person.\u201d<\/p>\n<h2 class=\"wp-block-heading\">Inside the IT worker operation<\/h2>\n<p>Kim was one among thousands of trained software developers deployed outside the DPRK to get lucrative jobs in tech using stolen identities. The delegations of workers are then forced to send the majority of their earnings to the government\u2014part of a global money-making and laundering empire that generates up to $600 million a year, according to <a href=\"https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf\" class=\"sc-19cc8fd2-0 iHosVH\">UN estimates<\/a>, not including the billions stolen in crypto heists.\u00a0<\/p>\n<p>Kim told <em>Fortune<\/em> his minimum earnings target was $5,000 per month up until the COVID-19 pandemic led to a boom in the remote IT sector. Once remote-work offerings exploded, his target amount doubled. Typically, the money was converted to U.S. dollars at local work sites overseas and then delivered either directly to North Korean headquarters or to a representative of the headquarters abroad.\u00a0<\/p>\n<p>\u201cMy primary job was to earn foreign currency through IT services,\u201d said Kim, according to an email translation of his interview responses. \u201cHowever, during the COVID-19 pandemic, I often received additional instructions to intensify regime propaganda online as well.\u201d<\/p>\n<p>Kim\u2019s interview was facilitated by <a href=\"https:\/\/pscore.org\/home\/\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/pscore.org\/home\/\" class=\"sc-19cc8fd2-0 iHosVH\">People for Successful Corean Reunification<\/a> (PSCORE), which provided translation and access. PSCORE was founded in 2006 by Kim Young-Il, a North Korean defector, and the group has worked with thousands of other former DPRK citizens who have since fled the country. PSCORE retains UN Economic and Social Council consultative status, which allows it to participate in <a href=\"https:\/\/pscore.org\/report\/unhrc-written-statement-2023\/\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/pscore.org\/report\/unhrc-written-statement-2023\/\" class=\"sc-19cc8fd2-0 iHosVH\">UN meetings<\/a> and research.\u00a0<\/p>\n<p>Kim is living in South Korea under an alias to avoid endangering his friends and family, who could be targeted by the DPRK government in retaliation for his actions and interviews with U.S. media. That chilling calculus keeps most North Korean IT workers in line, PSCORE secretary general Bada Nam told <em>Fortune<\/em>.\u00a0<\/p>\n<p>According to Nam, the regime\u2019s reach and control extends far beyond individual IT and other workers stationed abroad.\u00a0<\/p>\n<p>\u201cNot only their immediate family members, but even distant relatives could get punished if a relative escapes from North Korea,\u201d said Nam. \u201cThey are sending the message to the entire people of North Korea, \u2018If any family member defects from North Korea or betrays their fatherland, then they will get punished.\u2019\u201d<\/p>\n<p>Those who remain behind are often under constant and severe surveillance, Nam explained. DPRK government workers might be following a defector\u2019s family members in addition to entire neighborhoods. The consequences of a defection can be devastating.<\/p>\n<p>\u201cIn some cases, they send the entire family to political prison camp and they cannot get out of that camp for their entire life,\u201d he said.\u00a0<\/p>\n<p>Despite the risk, Kim has chosen to break his silence by answering questions from select news outlets.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Deception Tactics<\/h2>\n<p>Kim\u2019s method of disguising his true identity was elaborate and involved the use of popular tech networking and job websites.\u00a0<\/p>\n<p>\u201cI used platforms like Facebook, LinkedIn, Freelancer.com, and Upwork.com to pose as a client and post project listings,\u201d Kim said. \u201cI would then contact developers, negotiate with them\u2014including handling payment\u2014and gain access to their accounts.\u201d<\/p>\n<p>Using the identities of those who engaged with him on those platforms, whether they were European or American, Kim would then disguise himself using the identities of those who had sent bids to him. Thus, he was using real, verified identities in order to conceal his own, he said. Kim posted on other platforms as well, including <a href=\"http:\/\/freelance.com\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to http:\/\/freelance.com\" class=\"sc-19cc8fd2-0 iHosVH\">Freelance.com<\/a>, <a href=\"http:\/\/guru.com\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to http:\/\/guru.com\" class=\"sc-19cc8fd2-0 iHosVH\">Guru.com<\/a>, and Toptal, he said.<\/p>\n<p>In his work, Kim received and carried out development orders from multiple American companies, with his main area of work focused on e-commerce shopping sites and occasionally mobile app development. In Europe, he worked on developing a healthcare app. Kim declined to name any specific companies because he said sharing specifics could lead to inferences about his personal information.\u00a0\u00a0\u00a0<\/p>\n<p>While <a href=\"https:\/\/www.justice.gov\/usao-dc\/pr\/charges-and-seizures-brought-fraud-scheme-aimed-denying-revenue-workers-associated-north\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.justice.gov\/usao-dc\/pr\/charges-and-seizures-brought-fraud-scheme-aimed-denying-revenue-workers-associated-north\" class=\"sc-19cc8fd2-0 iHosVH\">Americans<\/a> in the U.S. have been <a href=\"https:\/\/www.justice.gov\/opa\/media\/1406391\/dl?inline\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.justice.gov\/opa\/media\/1406391\/dl?inline\" class=\"sc-19cc8fd2-0 iHosVH\">indicted<\/a> for knowingly taking part in the North Korean IT worker scheme by renting out their identities or hosting laptop farms in their homes, in Kim\u2019s experience, the Americans who were <a href=\"https:\/\/www.justice.gov\/archives\/opa\/pr\/justice-department-announces-arrest-premises-search-and-seizures-multiple-website-domains\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.justice.gov\/archives\/opa\/pr\/justice-department-announces-arrest-premises-search-and-seizures-multiple-website-domains\" class=\"sc-19cc8fd2-0 iHosVH\">involved<\/a> in the scheme were unwitting. He pushed back against a question referring to Americans involved in the scheme as \u201caccomplices.\u201d\u00a0<\/p>\n<p>\u201cIt would be more appropriate to say they were simply clients who placed orders for work,\u201d he said. \u201cThey had no idea we were from North Korea.\u201d<\/p>\n<p>He described the conditions he worked under as \u201crelatively decent.\u201d The workspace and sleeping quarters were \u201csufficiently spacious\u201d and the food conditions were \u201cgood.\u201d But work could also turn brutal if the IT workers weren\u2019t delivering on their financial targets.<\/p>\n<p>\u201cWe were required to work a minimum of 10 hours a day, and if we failed to meet the assigned targets, we were sometimes forced to work more than 18 hours a day,\u201d he said.\u00a0<\/p>\n<p>He denied ever being asked to share information with DPRK workers who engaged in crypto heists and claims he had \u201cno contact whatsoever with individuals involved in those activities.\u201d<\/p>\n<p>Direct contact with Kim\u2019s family wasn\u2019t possible, he said. During phone calls between his overseas team and the headquarters in North Korea, the IT workers would occasionally get brief updates about major family issues, although in principle, sharing personal family matters was forbidden.\u00a0<\/p>\n<p>\u201cWe could receive information if it was truly serious and deemed necessary,\u201d he said. \u201cConversely, in cases where something significant happened abroad\u2014such as an accident or serious illness\u2014the information could also be relayed back to our families through North Korean headquarters.\u201d<\/p>\n<h2 class=\"wp-block-heading\">Life after the Scheme<\/h2>\n<p>Kim\u2019s decision to defect comes at an enormous personal cost, in addition to the harsh reality that his family and even distant relatives could be in danger because of him. Nam said that fear\u2014coupled with extreme personal risk\u2014creates a psychological trap that stops most DPRK citizens from even thinking about escaping. If families attempt to contact defectors, it can become another tool for DPRK control.\u00a0<\/p>\n<p>\u201cThe regime could pressure the family to contact the defector in South Korea, asking them for small favors,\u201d said Nam. \u201cIf the defector responds, sending any information can slowly turn into a situation where they are being used as an unwilling source of information.\u201d<\/p>\n<p>Nam said some defectors have been recaptured afterward because they contacted family members.\u00a0<\/p>\n<p>For now, Kim remains in South Korea facing an uncertain future. He is skilled in IT so he plans to continue working in the field, but the psychological scars remain.\u00a0<\/p>\n<p>\u201cAs for how I feel\u2014it\u2019s a mix of the joy of gaining freedom and the sorrow of losing my family,\u201d said Kim. \u201cFrom my perspective, it feels like I\u2019ve lost more than I\u2019ve gained.\u201d<\/p>\n<p>He estimates there are thousands of IT workers operating the way he was, some overseas and others inside North Korea.\u00a0<\/p>\n<p>In response to a request, a Meta spokesperson declined to comment. LinkedIn directed <em>Fortune<\/em> to its <a href=\"https:\/\/www.linkedin.com\/pulse\/update-how-were-fighting-fake-accounts-will-nuland-ozspe\/?trackingId=7pPEHTMMRGKy0A7WWLtiWw%3D%3D\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.linkedin.com\/pulse\/update-how-were-fighting-fake-accounts-will-nuland-ozspe\/?trackingId=7pPEHTMMRGKy0A7WWLtiWw%3D%3D\" class=\"sc-19cc8fd2-0 iHosVH\">update<\/a> on fighting fake accounts. Upwork directed <em>Fortune<\/em> to its <a href=\"https:\/\/www.upwork.com\/blog\/upwork-statement-on-state-sponsored-threats\" target=\"_blank\" rel=\"noopener\" aria-label=\"Go to https:\/\/www.upwork.com\/blog\/upwork-statement-on-state-sponsored-threats\" class=\"sc-19cc8fd2-0 iHosVH\">approach<\/a> to state-sponsored threats.\u00a0Freelance.com., Freelancer.com, Guru.com, and Toptal did not immediately respond to requests for comment.<\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>For years, Kim Ji-min served as an IT worker inside a vast global scheme devised by North Korea\u2019s authoritarian leadership to evade crushing financial sanctions. Kim has since defected to&hellip;<\/p>\n","protected":false},"author":459,"featured_media":5143,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[6],"tags":[2863,1051,6424,2069,6426,6425],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>North Korean operative reveals the inner workings of the IT scam - Frisco Times<\/title>\n<meta name=\"description\" content=\"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/friscotimes.org\/?p=5142\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"North Korean operative reveals the inner workings of the IT scam - Frisco Times\" \/>\n<meta property=\"og:description\" content=\"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/friscotimes.org\/?p=5142\" \/>\n<meta property=\"og:site_name\" content=\"Frisco Times\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-02T08:36:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-04T06:44:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Amanda Gerut\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@FriscoTimes\" \/>\n<meta name=\"twitter:site\" content=\"@FriscoTimes\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Amanda Gerut\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/friscotimes.org\/?p=5142#article\",\"isPartOf\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142\"},\"author\":{\"name\":\"Amanda Gerut\",\"@id\":\"https:\/\/friscotimes.org\/#\/schema\/person\/3cd39958be2640ae6b703f3677391654\"},\"headline\":\"North Korean operative reveals the inner workings of the IT scam\",\"datePublished\":\"2025-07-02T08:36:14+00:00\",\"dateModified\":\"2025-07-04T06:44:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142\"},\"wordCount\":1438,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/friscotimes.org\/#organization\"},\"image\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142#primaryimage\"},\"thumbnailUrl\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg\",\"keywords\":[\"Korean\",\"North\",\"operative\",\"reveals\",\"scam\",\"workings\"],\"articleSection\":[\"Business\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/friscotimes.org\/?p=5142#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/friscotimes.org\/?p=5142\",\"url\":\"https:\/\/friscotimes.org\/?p=5142\",\"name\":\"North Korean operative reveals the inner workings of the IT scam - Frisco Times\",\"isPartOf\":{\"@id\":\"https:\/\/friscotimes.org\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142#primaryimage\"},\"image\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142#primaryimage\"},\"thumbnailUrl\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg\",\"datePublished\":\"2025-07-02T08:36:14+00:00\",\"dateModified\":\"2025-07-04T06:44:08+00:00\",\"description\":\"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.\",\"breadcrumb\":{\"@id\":\"https:\/\/friscotimes.org\/?p=5142#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/friscotimes.org\/?p=5142\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/friscotimes.org\/?p=5142#primaryimage\",\"url\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg\",\"contentUrl\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg\",\"width\":1200,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/friscotimes.org\/?p=5142#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/friscotimes.org\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"North Korean operative reveals the inner workings of the IT scam\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/friscotimes.org\/#website\",\"url\":\"https:\/\/friscotimes.org\/\",\"name\":\"Frisco Times\",\"description\":\"Your Gateway to San Francisco&#039;s Stories\",\"publisher\":{\"@id\":\"https:\/\/friscotimes.org\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/friscotimes.org\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/friscotimes.org\/#organization\",\"name\":\"Frisco Times\",\"url\":\"https:\/\/friscotimes.org\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/friscotimes.org\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2024\/06\/cropped-\u5fae\u4fe1\u622a\u56fe_20240625172131.png\",\"contentUrl\":\"https:\/\/friscotimes.org\/wp-content\/uploads\/2024\/06\/cropped-\u5fae\u4fe1\u622a\u56fe_20240625172131.png\",\"width\":512,\"height\":512,\"caption\":\"Frisco Times\"},\"image\":{\"@id\":\"https:\/\/friscotimes.org\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/FriscoTimes\",\"https:\/\/www.instagram.com\/friscotimes\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/friscotimes.org\/#\/schema\/person\/3cd39958be2640ae6b703f3677391654\",\"name\":\"Amanda Gerut\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/friscotimes.org\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/?s=96&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/?s=96&r=g\",\"caption\":\"Amanda Gerut\"},\"url\":\"https:\/\/friscotimes.org\/?author=459\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"North Korean operative reveals the inner workings of the IT scam - Frisco Times","description":"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/friscotimes.org\/?p=5142","og_locale":"en_US","og_type":"article","og_title":"North Korean operative reveals the inner workings of the IT scam - Frisco Times","og_description":"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.","og_url":"https:\/\/friscotimes.org\/?p=5142","og_site_name":"Frisco Times","article_published_time":"2025-07-02T08:36:14+00:00","article_modified_time":"2025-07-04T06:44:08+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg","type":"image\/jpeg"}],"author":"Amanda Gerut","twitter_card":"summary_large_image","twitter_creator":"@FriscoTimes","twitter_site":"@FriscoTimes","twitter_misc":{"Written by":"Amanda Gerut","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/friscotimes.org\/?p=5142#article","isPartOf":{"@id":"https:\/\/friscotimes.org\/?p=5142"},"author":{"name":"Amanda Gerut","@id":"https:\/\/friscotimes.org\/#\/schema\/person\/3cd39958be2640ae6b703f3677391654"},"headline":"North Korean operative reveals the inner workings of the IT scam","datePublished":"2025-07-02T08:36:14+00:00","dateModified":"2025-07-04T06:44:08+00:00","mainEntityOfPage":{"@id":"https:\/\/friscotimes.org\/?p=5142"},"wordCount":1438,"commentCount":0,"publisher":{"@id":"https:\/\/friscotimes.org\/#organization"},"image":{"@id":"https:\/\/friscotimes.org\/?p=5142#primaryimage"},"thumbnailUrl":"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg","keywords":["Korean","North","operative","reveals","scam","workings"],"articleSection":["Business"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/friscotimes.org\/?p=5142#respond"]}]},{"@type":"WebPage","@id":"https:\/\/friscotimes.org\/?p=5142","url":"https:\/\/friscotimes.org\/?p=5142","name":"North Korean operative reveals the inner workings of the IT scam - Frisco Times","isPartOf":{"@id":"https:\/\/friscotimes.org\/#website"},"primaryImageOfPage":{"@id":"https:\/\/friscotimes.org\/?p=5142#primaryimage"},"image":{"@id":"https:\/\/friscotimes.org\/?p=5142#primaryimage"},"thumbnailUrl":"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg","datePublished":"2025-07-02T08:36:14+00:00","dateModified":"2025-07-04T06:44:08+00:00","description":"Thousands of IT workers are trapped inside a global operation that funds North Korea\u2019s weapons program, but one managed to escape.","breadcrumb":{"@id":"https:\/\/friscotimes.org\/?p=5142#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/friscotimes.org\/?p=5142"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/friscotimes.org\/?p=5142#primaryimage","url":"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg","contentUrl":"https:\/\/friscotimes.org\/wp-content\/uploads\/2025\/07\/GettyImages-1152948615-e1751412877568.jpg","width":1200,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/friscotimes.org\/?p=5142#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/friscotimes.org\/"},{"@type":"ListItem","position":2,"name":"North Korean operative reveals the inner workings of the IT scam"}]},{"@type":"WebSite","@id":"https:\/\/friscotimes.org\/#website","url":"https:\/\/friscotimes.org\/","name":"Frisco Times","description":"Your Gateway to San Francisco&#039;s Stories","publisher":{"@id":"https:\/\/friscotimes.org\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/friscotimes.org\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/friscotimes.org\/#organization","name":"Frisco Times","url":"https:\/\/friscotimes.org\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/friscotimes.org\/#\/schema\/logo\/image\/","url":"https:\/\/friscotimes.org\/wp-content\/uploads\/2024\/06\/cropped-\u5fae\u4fe1\u622a\u56fe_20240625172131.png","contentUrl":"https:\/\/friscotimes.org\/wp-content\/uploads\/2024\/06\/cropped-\u5fae\u4fe1\u622a\u56fe_20240625172131.png","width":512,"height":512,"caption":"Frisco Times"},"image":{"@id":"https:\/\/friscotimes.org\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/FriscoTimes","https:\/\/www.instagram.com\/friscotimes\/"]},{"@type":"Person","@id":"https:\/\/friscotimes.org\/#\/schema\/person\/3cd39958be2640ae6b703f3677391654","name":"Amanda Gerut","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/friscotimes.org\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&r=g","caption":"Amanda Gerut"},"url":"https:\/\/friscotimes.org\/?author=459"}]}},"_links":{"self":[{"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/posts\/5142"}],"collection":[{"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/users\/459"}],"replies":[{"embeddable":true,"href":"https:\/\/friscotimes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5142"}],"version-history":[{"count":1,"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/posts\/5142\/revisions"}],"predecessor-version":[{"id":5144,"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/posts\/5142\/revisions\/5144"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/friscotimes.org\/index.php?rest_route=\/wp\/v2\/media\/5143"}],"wp:attachment":[{"href":"https:\/\/friscotimes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/friscotimes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/friscotimes.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}