Digital Investigations

They pass the interview. The laptop never leaves the farm.

North Korean IT workers operate under stolen U.S. identities, AI-spoofed faces, and facilitator logistics — then VPN into your stack from Pyongyang. Payroll becomes regime revenue. Source code becomes an access problem.

Cipher Cortex runs diligence on remote applicants, contractors, and vendors against a proprietary research corpus. We do not sell a public database. Engagement gets you answers.

The play

Stolen IDs. Fake LinkedIn. Laptop shipped to a U.S. farm. Worker in the DPRK. You think you hired a contractor in Texas.

The stakes

Sanctions exposure. Insider access. Credential theft. Contagious Interview-style malware campaigns running in parallel with the hiring fraud.

The ask

Before you onboard — or after something feels wrong — send us the persona, resume, or vendor. We tell you what we know.

What we actually run

Behind every diligence engagement is an internal graph we maintain continuously — people, front companies, facilitators, laptop farms, personas, emails, domains, AnyDesk IDs, phones, credentials, and infrastructure overlap. Confidence-scored. Timeline-aware. Cross-linked.

  • 01Match applicants and vendors to known DPRK IT revenue cells and aliases
  • 02Surface fake personas, resume reuse, and social-profile construction patterns
  • 03Correlate selectors: emails, usernames, domains, wallets, remote-access tooling
  • 04Map facilitator networks and laptop-farm logistics that keep the worker off-site
  • 05Deliver findings with confidence context — not hedging theater

The corpus is not a product page, a free lookup, or a public login. It exists so our analysts can answer you faster and with sharper attribution than open-source alone.

Who brings us cases

Security and trust & safety, HR and talent, legal and compliance, fraud units, staffing platforms, crypto and tech firms hiring remote engineers, and government-adjacent research programs.

How we work

Open-source collection, public reporting correlation, live infrastructure enrichment, and analyst review against the internal corpus. Scoped as a fixed engagement — not a subscription portal.

Suspect a worker. Prove it — or clear them.

Send a name, resume, LinkedIn, email, GitHub, or vendor packet. We scope remote-worker and DPRK IT diligence as a private engagement.

Request a Private Briefing