{"schema_version":"0.10.0","id":"LR-2026-0674","record_version":1,"title":"North Korean IT workers use real-time deepfakes to beat hiring checks","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":1.92,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"297e1a0fdec06424ffe0b8191ac33a2deb9c4299fbd07e1a8c18fa4fcaad2dff"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-31","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"North Korean IT operatives used real-time AI deepfake video to impersonate real people during live job interviews, then routed company laptops to overseas workers through laptop farms in US homes. The video feeds looked like a normal call to hiring managers who were not probing for AI artifacts. Eleven governments issued a joint alert on July 31, 2026. In April 2026, two US residents were sentenced for laptop farms that placed workers at more than 100 companies and compromised the identities of at least 80 American citizens. A legal analysis found that firms which unknowingly hired these workers were characterised as victims but are not in the clear. A proposed US bill would coordinate allied action against the schemes.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties, a stated count of two or more affected parties. Fact: the cited laptop farms helped workers obtain employment at more than 100 US companies.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm","publisher":"Tech Times","date":"2026-08-02","type":"press","title":"North Korean IT Workers Use Real-Time Deepfakes to Beat Hiring Checks, Eleven Nations Warn - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.date_disclosed":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"event.date_disclosed":[{"source_index":0,"quote":"On July 31, 2026, the governments of eleven allied nations — including the United States, Japan, South Korea, and, for the first time, France, Germany, Italy, and the Netherlands — issued a coordinated alert warning companies globally that North Korean IT operatives are now using real-time AI deepfake video to impersonate real people during live job interviews, bypassing the one control that most hiring teams believed would catch them."}],"event.incident_class":[{"source_index":0,"quote":"On July 31, 2026, the governments of eleven allied nations — including the United States, Japan, South Korea, and, for the first time, France, Germany, Italy, and the Netherlands — issued a coordinated alert warning companies globally that North Korean IT operatives are now using real-time AI deepfake video to impersonate real people during live job interviews, bypassing the one control that most hiring teams believed would catch them."}],"impact.severity":[{"source_index":0,"quote":"In April 2026, the Justice Department sentenced two New Jersey residents — Kejia Wang, 42, of Edison, and Zhenxing Wang, 39, of New Brunswick — to 108 months and 92 months in federal prison respectively for operating laptop farms that helped North Korean IT workers obtain employment at more than 100 US companies, compromising the stolen identities of at least 80 American citizens and generating more than $5 million for the regime."}],"impact.severity_because":[{"source_index":0,"quote":"In April 2026, the Justice Department sentenced two New Jersey residents — Kejia Wang, 42, of Edison, and Zhenxing Wang, 39, of New Brunswick — to 108 months and 92 months in federal prison respectively for operating laptop farms that helped North Korean IT workers obtain employment at more than 100 US companies, compromising the stolen identities of at least 80 American citizens and generating more than $5 million for the regime."}],"event.summary":[{"source_index":0,"quote":"On July 31, 2026, the governments of eleven allied nations — including the United States, Japan, South Korea, and, for the first time, France, Germany, Italy, and the Netherlands — issued a coordinated alert warning companies globally that North Korean IT operatives are now using real-time AI deepfake video to impersonate real people during live job interviews, bypassing the one control that most hiring teams believed would catch them."},{"source_index":0,"quote":"The result is indistinguishable from a normal video call to a hiring manager who is not specifically probing for AI artifacts."},{"source_index":0,"quote":"The July 31 joint advisory specifically identifies this technique — laptop farms where proxies in Western countries receive company-issued equipment and allow overseas actors to remotely access it — as a core operational method."},{"source_index":0,"quote":"In April 2026, the Justice Department sentenced two New Jersey residents — Kejia Wang, 42, of Edison, and Zhenxing Wang, 39, of New Brunswick — to 108 months and 92 months in federal prison respectively for operating laptop farms that helped North Korean IT workers obtain employment at more than 100 US companies, compromising the stolen identities of at least 80 American citizens and generating more than $5 million for the regime."},{"source_index":0,"quote":"A Skadden, Arps, Slate, Meagher & Flom analysis published in June 2026 found that while neither DOJ nor OFAC had yet filed enforcement actions against companies that inadvertently hired NK IT workers — characterizing those firms as \"victims\" — the firms \"are not in the clear.\""},{"source_index":0,"quote":"Four days before the joint advisory's publication, US Representative Young Kim (R-CA-40) introduced the North Korean Fraudulent Applicants Knowingly Enriching the Regime Act — referred to as the North Korean FAKER Act (H.R. 9963) — in the House of Representatives."}]},"notes_on_gaps":"No AI agent is described; the deepfakes were used by human operatives, so failure_class and agent-specific fields are omitted. No date of occurrence, detection method, trigger, root cause, responsible party, direct loss or exact record count is stated; the $800 million and $5 million figures are funds moved, not losses to victims. Disclosure date taken as the advisory date 2026-07-31. Severity 'major' is my judgement from stated counts of more than 100 companies and at least 80 identities. Control A6 was mapped by judgement to the statement about corporate IT allowlists; no listed control clearly matches the failed video interview check, so none is recorded for it. The remediation is advice from the sources, not a change a party reported making. Industry and country were not stated as incident facts and are left out. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Scheme funnelled about $800 million to Pyongyang in 2024.","quote":"The scheme funneled approximately $800 million to Pyongyang's nuclear weapons and ballistic missile programs in 2024 alone.","source_index":0,"when":"2024"},{"text":"OFAC sanctioned six individuals and two entities connected to the scheme.","quote":"In March 2026, the Treasury Department's Office of Foreign Assets Control blacklisted 21 cryptocurrency addresses across both blockchains as part of its action sanctioning six individuals and two entities connected to the scheme.","source_index":0,"when":"2026-03"},{"text":"Two New Jersey residents sentenced for operating laptop farms.","quote":"In April 2026, the Justice Department sentenced two New Jersey residents — Kejia Wang, 42, of Edison, and Zhenxing Wang, 39, of New Brunswick — to 108 months and 92 months in federal prison respectively for operating laptop farms that helped North Korean IT workers obtain employment at more than 100 US companies, compromising the stolen identities of at least 80 American citizens and generating more than $5 million for the regime.","source_index":0,"when":"2026-04"},{"text":"Two more laptop farm operators sentenced.","quote":"In May 2026, Matthew Issac Knoot of Nashville, Tennessee, and Erick Ntekereze Prince of New York each received 18-month sentences for running separate laptop farms that together affected nearly 70 companies and generated approximately $1.2 million for Pyongyang.","source_index":0,"when":"2026-05"},{"text":"Skadden analysis finds firms that unknowingly hired workers are not in the clear.","quote":"A Skadden, Arps, Slate, Meagher & Flom analysis published in June 2026 found that while neither DOJ nor OFAC had yet filed enforcement actions against companies that inadvertently hired NK IT workers — characterizing those firms as \"victims\" — the firms \"are not in the clear.\"","source_index":0,"when":"2026-06"},{"text":"North Korean FAKER Act referred to the House Foreign Affairs Committee.","quote":"The bill was referred to the House Foreign Affairs Committee on July 27, 2026, and had one cosponsor as of publication.","source_index":0,"when":"2026-07-27"},{"text":"Eleven governments issue a joint advisory on the deepfake hiring threat.","quote":"On July 31, 2026, the governments of eleven allied nations — including the United States, Japan, South Korea, and, for the first time, France, Germany, Italy, and the Netherlands — issued a coordinated alert warning companies globally that North Korean IT operatives are now using real-time AI deepfake video to impersonate real people during live job interviews, bypassing the one control that most hiring teams believed would catch them.","source_index":0,"when":"2026-07-31"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm"]}}