WageMole

WageMole is a North Korea-linked, state-sponsored threat activity cluster associated with the DPRK IT worker scheme. It is tracked as WageMole by ESET, and overlapping activity is also labeled UNC5267 and Jasper Sleet by other researchers. The activity involves operators posing as job seekers and using stolen, fabricated, or synthetic identities to obtain remote employment, particularly at Western companies, including organizations in the U.S. and Europe. Reported objectives include generating revenue for the DPRK regime and gaining footholds inside victim organizations. The cluster uses social engineering and fraudulent recruiting tradecraft, including forged resumes, fake LinkedIn and GitHub profiles, fabricated references, stolen personal data, fake passports and driver’s licenses, and AI-assisted or deepfake-enabled interviews. Reported recruitment and employment platforms include Upwork, Indeed, Freelancer, Telegram, and other job sites. Facilitators have been reported to help with account creation, bank accounts, mobile numbers or SIM cards, identity verification, and laptop farms in the victim’s country, while operators conceal location through VPNs, proxies, RMM tools, and VPS infrastructure. WageMole has been linked to fake front companies used to support recruitment lures and malicious GitHub activity, including DredSoftLabs, MetaMint Studio, MegaMint Studio, and JSoft Labs. Reporting cited in the content attributes DredSoftLabs to WageMole with high confidence and ties the activity to malicious GitHub repositories used in fake coding tests or interview tasks that ultimately deliver BeaverTail or OtterCookie malware. The content also states that WageMole overlaps with the related North Korea-linked activity cluster DeceptiveDevelopment, with ESET reporting that DeceptiveDevelopment appears to hand off stolen victim information to WageMole. Unit 42 distinguishes WageMole from Contagious Interview, describing the latter as malware delivery through fake interviews while WageMole focuses on fraudulent job-seeking and employment infiltration. Targets mentioned in the content include small to mid-sized businesses, Western companies, the U.S. tech sector, and in Europe particularly defense industrial base and government organizations. Reported risks include insider access, sensitive data theft, extortion by recently fired workers, and use of corporate access for further malicious activity.