This post is also available in:
עברית (Hebrew)
New research reveals that the North Korean cyber group known as Nickel Tapestry is evolving its remote work deception tactics, expanding beyond U.S. companies to infiltrate organizations in Europe and Asia. The group, notorious for deploying IT workers under false identities to generate income for the North Korean regime, is now employing generative AI, fabricated personas, and even impersonating women to evade detection.
According to a recent analysis by the Sophos Counter Threat Unit, the group has broadened its job application efforts to include cybersecurity positions in addition to its historical focus on blockchain and web development. These fraudulent applications are no longer limited to the tech sector and are now targeting industries with high-value data across several regions.
Nickel Tapestry’s schemes, linked to the broader North Korean “Wagemole” operation, rely on stolen or manipulated identities to place workers inside unsuspecting companies. Researchers have documented the use of digitally altered resumes, AI-generated images, and falsified LinkedIn profiles that present fake applicants as professionals from Vietnam, Japan, and Singapore. These deceptive practices are designed to bypass increasingly rigorous hiring processes, especially in remote work environments where face-to-face verification is limited.
Sophos highlights that generative AI is being leveraged to generate convincing resumes, automate image manipulation, and streamline communication between operatives and potential employers. Tactics also include using mouse jigglers to simulate activity, remote access tools such as KVM over IP, and VPNs to mask location and system language settings. Extended Zoom calls with screen sharing have reportedly been used to build trust and avoid scrutiny.
In some cases, the group has moved beyond espionage. Following the termination of fraudulent hires, organizations have reported cases of extortion involving stolen source code and sensitive intellectual property.
To counter these threats, experts recommend that hiring teams implement advanced identity verification methods and stay informed about emerging fraud tactics. Cybersecurity professionals are also urged to monitor for behavioral anomalies, such as unusual remote access patterns or data transfers, that may indicate insider threats.
The FBI and other agencies have taken steps to shut down front companies linked to the DPRK, but as these companies adapt, vigilance remains essential.
