Researchers at IBM X‑Force and Flare Research have uncovered data that sheds light on how North Korea’s fake IT worker schemes operate and infiltrate companies in order to funnel money back to the regime and steal sensitive information.

In a published report, ”Inside the North Korean infiltrator threat,” the pair detail evidence of the top-level infrastructure used to manage the operations, how workers apply for and secure IT roles, and mitigation strategies businesses can use to avoid falling victim.

The threat of North Korean nationals operating as remote IT contractors or full-time technology staff inside unsuspecting companies has come to light over the past several years, yet the report says security experts are only starting to realize the scale and sophistication of the operation.