Adversary Intelligence — 2026-04-21

North Korean operatives expand AI-enabled fake-identity hiring scheme into global tech firms

Radio Free Asia reports North Korean operatives are expanding the use of AI-generated credentials and deepfake identities to obtain technology jobs at foreign companies, with schemes now targeting employers across Europe and the Asia-Pacific in addition to the United States. The update follows the April 15 DOJ sentencing of U.S. facilitators Kejia Wang and Zhenxing Wang, who helped manage payment accounts for North Korean IT workers. Kejia Wang received a 108-month sentence, and the defendants were ordered to forfeit $600,000. The Justice Department says the original scheme involved the stolen identities of more than 80 Americans and infiltrated more than 100 U.S. companies, including Fortune 500 firms, netting about $88 million over six years routed through U.S. and Chinese financial channels to the DPRK.

Analysis
The Wang sentencings close the U.S. facilitator loop but leave the DPRK supply apparatus intact; per RFA, the scheme has since extended into Europe and Asia-Pacific, very likely relocating the revenue center to jurisdictions with weaker sanctions enforcement after U.S. wage routes drew federal exposure. The load-bearing enterprise risk figure is 80 stolen American identities penetrating 100 U.S. firms (Fortune 500 companies among them) generating roughly $88 million over six years routed through U.S. and Chinese financial channels, an exposure that will very likely drive a new CISA IAM and identity-proofing advisory cycle soon. Annual revenue is likely to rebound in 2026 given the scheme's structural resilience, and a European case announcement is very likely within the next 90 days given DOJ's consistent pattern of coordinating with allied prosecutors on DPRK financial routes. The geographic expansion claim, sourced solely to RFA, may instead reflect differential prosecution visibility; European authorities have grown more willing to name DPRK-linked cases publicly, inflating apparent operational scale without necessarily indicating genuine expansion.

1 sources

North Korean operatives use fake identities to apply for tech jobs - Radio Free Asia