Dutch Anti-Fraud Blogger Exposes North Korean Soldiers Remote Job Seeking Footage
Dutch anti-fraud blogger Deeveeaar released a video showcasing footage obtained through hacking, showing young men in North Korean military uniforms operating computers in a military-style room.
At least six individuals are seen in the same room, with visible clothes drying racks and beds, handling daily tasks while using computers. The computers run VPNs to hide their locations, and the individuals write code in English and Russian, using AI tools to modify resumes and information.
Deeveeaar stated that the footage was obtained by another hacker tracking remote job fraudsters on LinkedIn, who discovered that the individuals were soldiers after hacking into their computers and turning on the cameras. The individuals are seeking remote programming positions in the U.S. or Europe through platforms like LinkedIn, Upwork, and Indeed.
The video describes the individuals' goal as obtaining remote work to send their earnings back to the North Korean government. Deeveeaar pointed out that some operators are stationed near Pyongyang, not just overseas. Subsequent videos will continue to showcase the documents and behaviors of these operators.
The FBI and several media outlets previously reported that North Korean IT workers apply for remote positions using false or stolen identities and funnel their income back to the regime to fund military projects. Some workers are affiliated with military or intelligence-related units.
The remote job salaries and potential data access flow to North Korean operators, with company-paid salaries and client information possibly being used for regime funding and intelligence purposes. Companies face risks of false identity employment in their hiring processes and internal access controls.
Source: Public Information
ABAB AI Insight
Deeveeaar has been producing anti-fraud videos for a long time, tracking remote job fraudsters. His January 2026 video showcased footage provided by a third-party hacker, showing North Korean personnel in military uniforms using VPNs and AI tools to apply for Western remote positions in a military environment.
North Korean IT workers apply for remote programming jobs on platforms like LinkedIn using false or stolen identities, with most of their income funneled back to the regime. The U.S. Treasury and FBI have reported that such activities bring hundreds of millions of dollars to the regime, with some workers affiliated with military-related units operating domestically or in places like China and Russia.
Similar patterns can be seen in remote work and identity theft activities supported by other countries, with some organizations obtaining corporate access through false identities. North Korea is currently in a phase of using remote employment by IT workers as a means to evade sanctions and acquire funding, alongside traditional hacking attacks.
This represents a shift in regulation and sanction evasion: after international sanctions limited direct foreign exchange access, North Korea is converting corporate salaries into regime funds through remote work with false identities. The hiring processes and identity verification of companies have become nodes for the outflow of funds and data, altering the traditional path dominated by technical intrusions.
ABAB News · Cognitive Laws
- Remote identity equals a funding channel under sanctions
- Fake resumes plus AI equal lowered employment barriers
- Camera exposure equals operator location exposure