Full Report
Learn how North Korean IT worker threat cluster "PurpleDelta" uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to infiltrate organizations. Discover key indicators of compromise and mitigation strategies to protect your company from these fraudulent employment operations.
Analysis Summary
# Threat Actor: PurpleDelta
## Attribution & Identity
PurpleDelta is a state-directed cluster of North Korean IT workers. These operators are part of a government-mandated network of technology laborers operating globally.
* **Known Aliases:** Jasper Sleet (Microsoft), UNC5267 (Mandiant), Wagemole (Palo Alto Unit 42), Famous Chollima (CrowdStrike).
* **Associated Groups:** PurpleBravo (linked cluster known for malware deployment and crypto-sector targeting).
* **Location:** Operators are assessed to be likely based in China.
## Activity Summary
Between late 2024 and early 2025, Insikt Group identified a high-volume fraudulent employment campaign. PurpleDelta operators managed at least 22 fabricated personas to apply to over 1,100 companies, often submitting 60+ applications per day. The campaign successfully placed workers at ten or more organizations, where they functioned as insiders while funneling earnings back to the North Korean regime to finance military and nuclear programs.
## Tactics, Techniques & Procedures
* **Persona Management:** Use of multi-account management browsers (anti-detect browsers), separate Chrome profiles, and aged accounts on LinkedIn, GitHub, and Upwork to establish credibility.
* **AI-Enhanced Deception:** Deployment of AI-generated profile photos, custom-configured ChatGPT assistants for technical queries, and real-time AI transcription tools during interviews to provide scripted answers.
* **Identity Fraud:** Use of illicit ID-generation services and temporary phone number services to bypass verification.
* **Remote Access & Hardware Manipulation:** Use of "laptop farms" where local facilitators maintain company-issued hardware, allowing operators to connect via AnyDesk or other remote desktop software.
* **Operational Security (OPSEC):** Use of Google Translate to draft excuses for using personal devices or bank accounts and recording internal meetings for later review.
* **Coordination:** Use of Telegram and Slack for internal communications among operators and facilitators.
## Targeting
* **Sectors:** Software and Technology, Staffing and Consulting, Healthcare and Biotechnology, Fintech, and Financial Services.
* **Geography:** Global (remote technical roles), with a focus on companies hiring for Western-style remote positions.
* **Victims:** Over 1,100 targeted companies; at least 10 confirmed/probable active placements.
## Tools & Infrastructure
* **Software/Platforms:** AnyDesk (account renting/remote access), ChatGPT (custom assistants), Google Translate, GitHub, LinkedIn, Medium, Upwork.
* **Infrastructure (Defanged):**
* 23[.]106[.]169[.]120
* 104[.]129[.]55[.]3
* 104[.]253[.]1[.]79
* 104[.]253[.]115[.]254
* 155[.]94[.]198[.]2
* 167[.]88[.]61[.]117
* 204[.]188[.]232[.]195
* *(Refer to Appendix A in source for the full list of 50+ IPs)*
## Implications
PurpleDelta presents a significant material risk as an insider threat. Beyond illicit revenue generation (estimated at hundreds of millions of dollars annually for the DPRK), the group provides a foothold for intelligence collection. Their access to internal systems, source code, and proprietary data facilitates potential downstream supply-chain attacks and strategic espionage.
## Mitigations
* **Enhanced Identity Verification:** Implement live video identity checks requiring candidates to show government-issued IDs.
* **Employment Background Checks:** Cross-reference provided work history against open-source employment records and perform rigorous verification of education/references.
* **Technical Controls:**
* Monitor for the use of remote desktop software (e.g., AnyDesk, TeamViewer) on corporate assets.
* Identify unauthorized screen recording or AI transcription tools.
* Audit for logins originating from known VPN/VPS IP ranges or suspicious geographic shifts.
* **Interview Protocol:** Use unconventional technical questions or live coding environments that are difficult to bypass using standard LLM prompts.