PurpleDelta

PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint, a second remote-management tool on the company laptop, and a device whose location never matches the login

Insikt Group published its PurpleDelta analysis on 2026-08-18, covering what it describes as a state-directed network of covert North Korean technology workers operating across freelancing platforms and corporate hiring pipelines. On naming, Insikt is unhedged: "The group overlaps with threat actor designations used by other vendors, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima" (Insikt Group, 2026-08-18); these are presented as different vendors' labels for the same phenomenon rather than as a graded attribution claim. The quantified dataset covers one cluster: "Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors" (Insikt Group, 2026-08-18), sometimes at a rate of at least 60 positions a day, with at least 22 fabricated personas maintained across clusters and operators "highly likely to be actively employed by at least ten organizations", Insikt's own hedge, kept as one here.

The geography is the reason this is not a North American story. Roughly four in five target companies were North American, "but the operators applied to companies in every region of the world" (Insikt Group, 2026-08-18), and the sector concentration (software and technology, then staffing and consulting, then healthcare and biotechnology) describes the supplier tier that public-sector and critical-infrastructure organisations in this constituency buy remote technical labour through. This store already carries a Flemish Government agency confirming a North Korean compromise that reached it through a contractor's workstation, which is the same structural exposure arriving by a different route: the organisation's own hiring controls are not the only ones that matter.

What makes the report useful rather than merely alarming is that the fraud leaves endpoint artifacts, and Insikt separates its technical recommendations from its hiring-process advice. The operating model is that a facilitator physically holds the employer-issued laptop while the operator works it remotely over commercial remote-desktop software, with a commercial VPN marketed for circumventing China's national firewall used consistently for connectivity, and Insikt places many of the operators' nexus in Shenyang on the basis of professional profiles, social-media presence and artifacts on their systems. That arrangement cannot be run without leaving two things on a managed device: a remote-access agent the employer did not install, and a persistent mismatch between where the hardware is and where the person claims to be. Insikt's own controls address exactly those, "If you run remote monitoring and management (RMM) software in your organization, ensure that no other RMM software is installed, and deny-list other RMM software on your networks" and "Regularly geolocate company laptops to verify that their locations match employee login locations" (Insikt Group, 2026-08-18), alongside regular port-checking to detect remote access via desktop sharing or VPNs, insider-threat monitoring on company devices, and a requirement that company hardware never be shipped to an anonymised post box or to anyone other than the named individual.

The persona-construction tradecraft is worth knowing mainly because it explains why interview-stage scrutiny fails. Profile photographs come from a face-swapping service and are kept locally on the operator's machine in a dedicated directory; identity documents come from a paid document-generation service; identities and accounts are bought, with Insikt directly observing the purchase of US and Ukrainian identities, while its separate observation of the operators across infostealer-log channels is recorded only as suggesting they may also be buying stolen credentials; contribution histories on code-hosting platforms are fabricated; and multi-account browsers with separate browser profiles and calendars keep the personas apart. Insikt also lists Android emulation software among the operators' tooling without stating what it is used for, and no purpose is inferred here. During live interviews the operators record and transcribe the call and feed questions to purpose-configured chatbot assistants, reading the answers back; Insikt notes the answers were sometimes visibly wrong, which indicates limited subject-matter command rather than genuine skill. One operator was observed running two personas in parallel, one already employed and one interviewing elsewhere, and interview and meeting times for different personas were seen to collide.

Unit 42's dataset of 405 AI-enabled malware samples finds 97% never leave sandboxes, and every sample that reached a production environment was caught by existing behavioural detection with no novel approach required

Unit 42 analysed 405 AI-enabled malware samples and reports that approximately 97% exist only in research repositories and public sandboxes such as VirusTotal; "approximately 97% of the samples we examined exist only in sandboxes and on VirusTotal" (Palo Alto Networks Unit 42, 2026-08-25), with just 12 samples observed attempting to reach production environments across Cortex XDR-protected endpoints, and every one of those 12 detected and blocked before execution completed. Five malware families accounted for the in-the-wild attempts: FunkSec ransomware, a set of trojanised AI-branded applications, the Oyster backdoor, the Rhadamanthys stealer, and a COM-hijacking DLL.

The most concrete evidence of LLM-assisted development speed is FunkSec, which the report says produced seven distinct ransomware-builder variants in six days: "seven distinct builds in six days is a pace that suggests LLM-assisted development, where generating a new variant is closer to a prompt generation rather than a software development task" (Palo Alto Networks Unit 42, 2026-08-25). The report's central, counter-hype finding is that none of the 405 samples required a novel detection approach: "none of the AI-enabled samples in our dataset required a novel detection approach. The AI component influenced how the malware was written, but the resulting binary still exhibits the same behavioral indicators that existing detection logic targets" (Palo Alto Networks Unit 42, 2026-08-25), sandbox detonation, behavioural analytics, code-signing anomaly detection and entropy analysis caught every sample without modification.

This is a direct, data-rich complement to the "AI bought throughput not capability" thread already covered here on 2026-08-23 (Talos/UAT-10147, Bitdefender/SilkParasite, CISA/Siemens-S7-tooling, Insikt/PurpleDelta): Unit 42 supplies the quantitative production-versus-sandbox ratio and detection-sufficiency claim that the earlier reporting argued qualitatively, without repeating any of that reporting's own findings.

The direct calibration input for a SOC is whether to invest in AI-malware-specific detection tooling versus trusting existing behavioural and sandbox pipelines, Unit 42's own data argues for the latter, though as a vendor's account of its own products' performance rather than an independently-verified detection-rate statistic.

Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan

Kudelski Security, a Swiss research lab headquartered in Cheseaux-sur-Lausanne, reconstructs connections between North Korean state-linked cybercrime and fake-IT-worker operations via a stealer-log leak. An actor the researchers designate "Bismarck," linked to DPRK-run gambling platforms, reused infrastructure that overlaps with the FakeCalls Android banking trojan (previously documented by Check Point targeting South Korean banking customers via voice-phishing app impersonation): "we recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed 'Bismarck.' The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea" (Kudelski Security, 2026-08-12). Kudelski assesses the infrastructure reuse most plausibly reflects that the gambling-operation domains were purchased by DPRK associates rather than by Bismarck directly.

Separately, a DPRK-affiliated manager's own WinSCP credential vault (stolen in a 2021 leak) held access to historical Emotet botnet loader infrastructure, and cross-referencing that infrastructure's later reuse ties it into a loader role for subsequent campaigns. The investigation names operational bases and identifies university-affiliated IT-worker pipelines at named North Korean technical universities, plus organisational entities supporting fake IT-worker placement across multiple countries, directly relevant tradecraft for this constituency's HR and identity-vetting teams screening remote-hire pipelines, where a DPRK IT worker's fabricated identity and credentials are the initial-access vector rather than a technical exploit.

Kudelski does not relate Bismarck to any previously named North Korean IT-worker cluster: its report names Bismarck, several DPRK universities and the "Base" system, and makes no comparison to other tracked clusters either way. This is a research/awareness finding for HR and identity-vetting process design rather than a technical exposure with a specific patch, hunt or block action.