ZachXBT: North Korean IT personnel exposed as operating 30+ fake identities, involved in $680,000 attack

PANews reported on August 13th that ZachXBT revealed that a source hacked into the devices of North Korean IT personnel and discovered that a small team of them had obtained developer positions using more than 30 fake identities, purchased Upwork and LinkedIn accounts using government IDs, and worked through AnyDesk. The relevant data included Google Drive exports, Chrome profiles, and screenshots.

Wallet address 0x78e1 is closely linked to the $680,000 attack on the Favrr platform in June 2025. More North Korean IT personnel have also been identified. The team used Google products to schedule tasks, purchase SSNs, AI subscriptions, and VPNs. Some browsing history showed frequent use of Google Translate for Korean translations, and the IP address was Russian. Neglect by recruiters and a lack of coordination between services are major challenges in combating this activity.