Loading threat actor…
Jasper Sleet is a North Korean threat cluster tracked primarily in connection with the DPRK remote IT worker program, a long-running operation in which operatives use stolen, rented, or fabricated identities to obtain remote technical employment at legitimate organizations. The activity is widely associated with revenue generation for the North Korean regime and also creates opportunities for espionage, insider abuse, data theft, and extortion. Reported aliases include Storm-0287, Wagemole, PurpleDelta, Nickel Tapestry, and UNC5267. The group’s tradecraft centers on fraudulent employment and sustained misuse of legitimate access. Operators build convincing digital personas using forged or altered identity materials, fabricated professional histories, social media profiles, developer portfolios, and tailored resumes and cover letters. They have been observed using generative AI to research job postings, extract required skills, generate culturally appropriate names and communications, improve profile photos, and maintain believable workplace interactions after hiring. Additional deception methods include face-swapping on identity documents and voice-changing software during interviews. Once embedded in victim environments, Jasper Sleet-linked operators use legitimate access to blend into normal activity, maintain long-term persistence, answer technical questions, generate code, and continue professional communications with AI assistance. Reporting also attributes post-compromise activity to these North Korean remote worker operations, including environment analysis, credential theft, privilege escalation, lateral movement, sensitive data theft, and efforts to evade detection. Victim reporting and law-enforcement actions indicate theft of intellectual property, source code, trade secrets, and other sensitive records, with some cases escalating to extortion demands tied to threatened public disclosure. Historically the operation focused heavily on U.S. organizations, especially technology-related roles, but reporting indicates expansion to broader global targeting and multiple industries. Facilitator networks and laptop-farm infrastructure have been used to mask operators’ true locations and support fraudulent employment at scale. Jasper Sleet is part of the broader DPRK cyber ecosystem and overlaps operationally with related North Korean clusters involved in remote worker fraud and adjacent social-engineering activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced in connection with Microsoft's reporting on infiltrating IT workers and cloud/identity detection strategies.
Uses AI to enhance tradecraft, including sustained large-scale misuse of legitimate access, identity fabrication through social engineering, and long-term persistence at low cost.
North Korean IT worker operation using fake identities and fraudulent employment to infiltrate companies, generate revenue for the DPRK, steal sensitive data, and in some cases conduct extortion. The group also uses AI to fabricate identities, support social engineering, and maintain long-term access.
Conducting North Korean fake-employee infiltration operations against western companies, using generative AI, voice-changing software, face-swapping, forged identity documents, and AI-assisted job applications to obtain and maintain remote employment inside organizations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.