10 minhigh
PurpleDelta's Fraudulent Employment Operations
Insikt Group identified clusters of activity linked to PurpleDelta, a North Korean IT worker group operating from China. Between late 2024 and early 2025, the group applied to over 1,100 companies using 22 fabricated personas, leveraging AI tools and identity services to bypass hiring controls. Operators secured employment at over ten organizations, recording internal meetings and using personal devices to maintain access. The operation relies on facilitators to manage company-issued hardware and uses remote desktop tools for persistent access.
Sens:▲ 24hConf:high
Showing defanged values
- domainminicursor[.]comDomain registered by PurpleDelta operators to advertise for 'tech representatives' and create freelancer accounts on their behalf.
- domaintrustidcard[.]comService used by PurpleDelta operators to generate ID cards for their personas.
- ip104[.]129[.]55[.]3IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]102[.]119IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]103[.]238IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]111[.]106IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]112[.]86IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]115[.]202IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]115[.]254IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]120[.]177IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]120[.]203IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]121[.]146IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]134[.]123IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]137[.]28IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]145[.]255IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]145[.]7IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]147[.]147IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]14[.]73IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]160[.]220IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]164[.]246IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]17[.]141IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]173[.]139IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]177[.]189IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]1[.]79IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]19[.]244IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]199[.]214IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]20[.]50IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]207[.]214IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]221[.]132IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]224[.]179IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]224[.]93IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]226[.]188IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]229[.]199IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]229[.]208IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]243[.]171IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]245[.]40IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]251[.]19IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]254[.]82IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]34[.]67IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]44[.]236IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]45[.]193IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]46[.]118IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]47[.]239IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]51[.]76IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]52[.]123IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]56[.]226IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]7[.]202IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]72[.]75IP address associated with PurpleDelta operator infrastructure.
- ip104[.]253[.]90[.]150IP address associated with PurpleDelta operator infrastructure.
- ip155[.]94[.]198[.]2IP address associated with PurpleDelta operator infrastructure.
- ip167[.]88[.]61[.]117IP address associated with PurpleDelta operator infrastructure.
- ip167[.]88[.]61[.]250IP address associated with PurpleDelta operator infrastructure.
- ip189[.]1[.]170[.]50IP address associated with PurpleDelta operator infrastructure.
- ip192[.]161[.]60[.]140IP address associated with PurpleDelta operator infrastructure.
- ip204[.]188[.]232[.]195IP address associated with PurpleDelta operator infrastructure.
- ip218[.]24[.]120[.]118IP address associated with PurpleDelta operator infrastructure.
- ip23[.]106[.]169[.]120IP address associated with PurpleDelta operator infrastructure.
Detection / Hunteropenrouter
What Happened
A group of North Korean IT workers called PurpleDelta has been fraudulently applying for remote jobs at over 1,100 companies using fake identities. They use artificial intelligence tools to generate profile photos, write resumes, and answer questions during video interviews in real time. Once hired, they record company meetings, use personal laptops instead of company-issued ones, and try to redirect their pay to personal bank accounts. They also use people in other countries to receive and set up company laptops, which they then access remotely. Organizations hiring for remote technical roles should review their hiring processes, verify identities carefully, and watch for signs of fraudulent employees.
Key Takeaways
- PurpleDelta operators applied to over 1,100 companies using at least 22 fabricated personas, maintaining a high operational tempo of up to 60 applications per day.
- Operators leveraged AI tools, including custom ChatGPT assistants and real-time transcription, to deceive hiring managers during interviews, sometimes repeating AI responses verbatim.
- Once employed, operators recorded internal meetings, used screen recording software, and used pre-written excuses to justify using personal devices and bank accounts.
- Facilitators in target countries received and maintained company-issued hardware, installing remote desktop software for operator access.
- Operators used identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, coordinating via Telegram and Slack.
Affected Systems
- Remote work infrastructure
- Corporate hiring pipelines
- Freelance platforms (Upwork, Indeed, ZipRecruiter, etc.)
- Company-issued laptops managed by facilitators
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Operators apply to remote job positions using fabricated personas supported by AI-generated photos, custom ChatGPT assistants, and forged identity documents.
- Execution: During interviews, operators use screen recording, AI transcription, and chatbot tools to generate real-time answers, repeating AI responses verbatim.
- Persistence: Once employed, operators use facilitators to receive and maintain company-issued hardware, installing remote desktop software (AnyDesk, Chrome Remote Desktop) for persistent access.
- Defense Evasion: Operators use Google Translate to draft pre-written excuses to justify using personal devices and bank accounts, and record internal meetings.
- Collection: Operators record internal meetings and maintain access to proprietary systems and data.
- Exfiltration: Operators steer payments toward personal bank accounts and cryptocurrency, funneling earnings through facilitators and front companies.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would detect remote desktop software installations and screen recording tools on company-issued hardware, but may lack visibility into personal devices used by operators. |
| Network Visibility | Medium | Network monitoring can detect connections to known PurpleDelta IP addresses and the use of commercial VPNs like Astrill, but encrypted traffic to legitimate platforms limits deep inspection. |
| Detection Difficulty | Hard | Operators use legitimate platforms and AI tools to blend in with normal remote work activity. Detecting fraudulent employment requires correlating HR data, identity verification, and technical indicators, which spans multiple teams and data silos. |
Required Log Sources
- VPN authentication logs
- Remote desktop software installation logs
- DNS resolution logs
- Web proxy logs
- HR onboarding and identity verification records
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for newly onboarded remote employees who immediately request to use personal devices instead of company-issued hardware, citing emergencies. | EDR telemetry, IT helpdesk ticketing systems, device inventory logs | Persistence | Medium - legitimate employees may occasionally need to use personal devices during onboarding or equipment delays. |
| Hunt for remote desktop software (e.g., AnyDesk, Chrome Remote Desktop) installed on company-issued laptops shortly after onboarding. | EDR process execution and installation logs | Persistence | Low - unauthorized RMM software installation is typically against policy. |
| Hunt for screen recording software (e.g., iTop Screen Recorder) executing on company-issued devices. | EDR process execution logs | Collection | Low - screen recording software is uncommon in corporate environments. |
| Hunt for network connections to known PurpleDelta IP addresses or the use of Astrill VPN endpoints. | Firewall logs, DNS logs, web proxy logs | Command and Control | Low - these IPs and VPN use are specific to the threat actor. |
| Hunt for multiple concurrent active sessions from a single device or IP address using different user identities. | VPN logs, authentication logs, EDR telemetry | Persistence | Medium - shared devices in legitimate remote work environments could generate similar patterns. |
Control Gaps
- Standard identity verification processes during hiring may not catch AI-assisted persona fraud.
- Network controls may not block legitimate remote desktop tools or commercial VPNs by default.
- Endpoint monitoring may not extend to personal devices used by operators.
- HR and security teams may lack integrated processes to flag suspicious onboarding behavior.
Key Behavioral Indicators
- Use of screen recording software (iTop Screen Recorder) during work hours.
- Installation of remote desktop tools (AnyDesk, Chrome Remote Desktop, Jump Desktop, RealVNC) on company devices.
- Use of multi-account management browsers (Wavebox) or multiple Chrome profiles on a single device.
- Network connections from Astrill VPN IP ranges.
- Requests to redirect payment to personal bank accounts or cryptocurrency wallets shortly after hiring.
- Use of AI transcription tools (Krisp, Caption.Ed) during meetings.
False Positive Assessment
Medium - The use of remote desktop tools, commercial VPNs, and personal devices can occur in legitimate remote work scenarios, requiring correlation with HR and identity data to confirm.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Review recent hires for indicators of compromise, including the use of personal devices, requests for payment redirection, and installation of remote desktop software.
- If your EDR supports host isolation, consider isolating company-issued devices that match the behavioral indicators or have connected to known PurpleDelta IP addresses.
- Consider blocking the listed PurpleDelta IP addresses at your firewall or web proxy, if supported by your tooling.
Infrastructure Hardening
- Evaluate whether your network policies can deny-list commercial VPNs, particularly Astrill, for corporate device connections.
- Consider implementing stricter identity verification processes for remote candidates, including live video identity checks against government-issued IDs.
- If you run remote monitoring and management (RMM) software, evaluate deny-listing other RMM tools like AnyDesk and Chrome Remote Desktop.
- Consider implementing insider threat monitoring software on company devices, if supported by your tooling.
User Protection
- Consider educating hiring managers and HR staff on the PurpleDelta TTPs, including the use of AI in interviews and common excuses for using personal devices.
- If applicable, consider requiring employees to shut off commercial VPNs when accessing company networks.
- Consider implementing a policy requiring in-person signature for receipt of company-issued hardware.
Security Awareness
- Consider rolling existing security awareness training to include social engineering tactics related to fraudulent employment and account sharing.
- Consider educating employees on the risks of lending their identities, accounts, or devices to third parties for remote work.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Ips:
104[.]253[.]1[.]79- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]7[.]202- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]14[.]73- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]17[.]141- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]19[.]244- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]20[.]50- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]34[.]67- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]44[.]236- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]45[.]193- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]46[.]118- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]47[.]239- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]51[.]76- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]52[.]123- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]56[.]226- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]72[.]75- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]90[.]150- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]102[.]119- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]103[.]238- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]111[.]106- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]112[.]86- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]115[.]202- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]115[.]254- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]120[.]177- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]120[.]203- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]121[.]146- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]134[.]123- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]137[.]28- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]145[.]7- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]145[.]255- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]147[.]147- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]160[.]220- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]164[.]246- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]173[.]139- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]177[.]189- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]199[.]214- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]207[.]214- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]221[.]132- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]224[.]93- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]224[.]179- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]226[.]188- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]229[.]199- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]229[.]208- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]243[.]171- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]245[.]40- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]251[.]19- IP address associated with PurpleDelta operator infrastructure.104[.]253[.]254[.]82- IP address associated with PurpleDelta operator infrastructure.
- Domains:
trustidcard[.]com- Service used by PurpleDelta operators to generate ID cards for their personas.
- Other:
skdmldjajsl- Partial password string used by an operator. When typed on a Korean keyboard, it becomes the phrase 'my mother' in Korean.cjsflak- Partial string used by an operator. When entered on a Korean keyboard, it becomes the word for a mythical horse from East Asian folklore.
Stay currentSubscribe via RSS
