TRM Labs(@trmlabs):Over the last few years, TRM has tracked the growing sophistication of North Korea's IT worker operations — and this latest investigation makes clear how far they’ve come. In a new piece for Indicator — which includes insights from TRM — Craig Silverman went inside a DPRK-linked operation that recruited unwitting freelancers in the Philippines, Nigeria, and Colombia to conduct real Zoom interviews, complete with live coding exercises that quietly exfiltrated passwords and crypto wallets the moment a candidate engaged. Read Craig's full investigation ➡️

2026.06.16 14:00

Over the last few years, TRM has tracked the growing sophistication of North Korea's IT worker operations — and this latest investigation makes clear how far they’ve come. In a new piece for Indicator — which includes insights from TRM — Craig Silverman went inside a DPRK-linked operation that recruited unwitting freelancers in the Philippines, Nigeria, and Colombia to conduct real Zoom interviews, complete with live coding exercises that quietly exfiltrated passwords and crypto wallets the moment a candidate engaged. Read Craig's full investigation ➡️