According to ZachXBT, a source hacked into the devices of North Korean IT personnel and discovered that a small team of them used over 30 fake identities to obtain developer positions, purchased Upwork and LinkedIn accounts using government IDs, and worked through AnyDesk. The data included Google Drive exports, Chrome profiles, and screenshots.

The wallet address 0x78e1 is closely linked to the $680,000 attack on the Favrr platform in June 2025. More North Korean IT personnel have also been identified. The team used Google products to schedule tasks and purchase SSNs, AI subscriptions, and VPNs. Some browsing history showed frequent use of Google Translate for Korean translations, and the IP address was Russian. Neglect by recruiters and a lack of coordination between services are major challenges in combating this activity.