ZachXBT: North Korean IT Team Has Over 30 Fake Identities, Involved in $680,000 Attack Incident

【ZachXBT: North Korean IT Team Has Over 30 Fake Identities, Involved in $680,000 Attack Incident】On August 13, news reported by ZachXBT revealed that an insider hacked into North Korean IT personnel's devices and discovered that their small team obtained developer positions through over 30 fake identities, using government IDs to purchase Upwork and LinkedIn accounts, and conducting work via AnyDesk. Relevant data includes Google Drive exports, Chrome profiles, and screenshots. Wallet address 0x78e1 is closely related to the $680,000 attack on the Favrr platform in June 2025, and more North Korean IT personnel have also been identified. The team utilized Google products to organize tasks and purchased SSNs, AI subscriptions, and VPNs. Some browsing records show frequent use of Google Translate to translate Korean, with IP addresses traced to Russia. The negligence of recruiters and the lack of collaboration between services pose major challenges in combating such behaviors.