DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

overseas IT workers (4)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
From approximately September 2019 through November 2022Phagnasay, Salazar and Travis identity-lending IT worker scheme (S.D. Ga.)United Statesoverseas IT workers (DPRK scheme)
from on or about September 23, 2020, until on or about October 28, 2022Jason Salazar allowed his identity to be used by overseas DPRK IT workers; received laptops and installed remote access softwareU.S. (Georgia)overseas IT workers (DPRK IT worker scheme); Jason Salazar
Beginning in at least September of 2021, through up to and including May 16, 2024Oleksandr Didenko's Upworksell.com identity-rental service and U.S. laptop farms used by overseas (North Korean) IT workersU.S. (laptop farms incl. Virginia, Tennessee)overseas IT workers (some clients "are from North Korea"); Oleksandr Didenko
Audricus Phagnasay allowed his identity to be used by overseas DPRK IT workers; received laptops and installed remote access softwareU.S. (Georgia)overseas IT workers (DPRK IT worker scheme); Audricus Phagnasay