PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint — a second remote-management tool on the company laptop, and a device whose location never matches the login
Insikt Group published its PurpleDelta analysis on 2026-08-18, covering what it describes as a state-directed network of covert North Korean technology workers operating across freelancing platforms and corporate hiring pipelines. On naming, Insikt is unhedged: "The group overlaps with threat actor designations used by other vendors, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima" (Insikt Group, 2026-08-18) — these are presented as different vendors' labels for the same phenomenon rather than as a graded attribution claim. The quantified dataset covers one cluster: "Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors" (Insikt Group, 2026-08-18), sometimes at a rate of at least 60 positions a day, with at least 22 fabricated personas maintained across clusters and operators "highly likely to be actively employed by at least ten organizations" — Insikt's own hedge, kept as one here.
The geography is the reason this is not a North American story. Roughly four in five target companies were North American, "but the operators applied to companies in every region of the world" (Insikt Group, 2026-08-18), and the sector concentration — software and technology, then staffing and consulting, then healthcare and biotechnology — describes the supplier tier that public-sector and critical-infrastructure organisations in this constituency buy remote technical labour through. This store already carries a Flemish Government agency confirming a North Korean compromise that reached it through a contractor's workstation, which is the same structural exposure arriving by a different route: the organisation's own hiring controls are not the only ones that matter.
What makes the report useful rather than merely alarming is that the fraud leaves endpoint artifacts, and Insikt separates its technical recommendations from its hiring-process advice. The operating model is that a facilitator physically holds the employer-issued laptop while the operator works it remotely over commercial remote-desktop software, with a commercial VPN marketed for circumventing China's national firewall used consistently for connectivity, and Insikt places many of the operators' nexus in Shenyang on the basis of professional profiles, social-media presence and artifacts on their systems. That arrangement cannot be run without leaving two things on a managed device: a remote-access agent the employer did not install, and a persistent mismatch between where the hardware is and where the person claims to be. Insikt's own controls address exactly those — "If you run remote monitoring and management (RMM) software in your organization, ensure that no other RMM software is installed, and deny-list other RMM software on your networks" and "Regularly geolocate company laptops to verify that their locations match employee login locations" (Insikt Group, 2026-08-18), alongside regular port-checking to detect remote access via desktop sharing or VPNs, insider-threat monitoring on company devices, and a requirement that company hardware never be shipped to an anonymised post box or to anyone other than the named individual.
The persona-construction tradecraft is worth knowing mainly because it explains why interview-stage scrutiny fails. Profile photographs come from a face-swapping service and are kept locally on the operator's machine in a dedicated directory; identity documents come from a paid document-generation service; identities and accounts are bought, with Insikt directly observing the purchase of US and Ukrainian identities, while its separate observation of the operators across infostealer-log channels is recorded only as suggesting they may also be buying stolen credentials; contribution histories on code-hosting platforms are fabricated; and multi-account browsers with separate browser profiles and calendars keep the personas apart. Insikt also lists Android emulation software among the operators' tooling without stating what it is used for, and no purpose is inferred here. During live interviews the operators record and transcribe the call and feed questions to purpose-configured chatbot assistants, reading the answers back — Insikt notes the answers were sometimes visibly wrong, which indicates limited subject-matter command rather than genuine skill. One operator was observed running two personas in parallel, one already employed and one interviewing elsewhere, and interview and meeting times for different personas were seen to collide.
The group overlaps with threat actor designations used by other vendors, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima.
Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors.
Roughly 80% of the companies are based in North America, but the operators applied to companies in every region of the world.
If you run remote monitoring and management (RMM) software in your organization, ensure that no other RMM software is installed, and deny-list other RMM software on your networks.
Regularly geolocate company laptops to verify that their locations match employee login locations.
Defender actions
- Inventory remote-monitoring-and-management agents across corporate endpoints and alert on any second RMM or remote-desktop agent appearing on a device that already carries the sanctioned one — Insikt names this as its own primary technical control, and it is the artifact a facilitator-held laptop necessarily produces.
- Compare the geolocation of company-issued laptops against the claimed work location and the source of that employee's authentications, starting with remote contractor devices shipped rather than handed over in person.
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1585.001Establish Accounts: Social Media Accounts
Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1199Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Command and Control TA0011
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
T1219.002Remote Access Tools: Remote Desktop Software
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.