North Korea's hiring funnel: 60 applications a day, 22 personas, ten jobs landed

Recorded Future's Insikt Group has published research on PurpleDelta, its designation for North Korean IT workers, describing operators likely based in China who applied for jobs at more than 1,100 companies between late 2024 and early 2025 ^[1][2]. Insikt assesses those clusters were highly likely to be actively employed at ten or more organizations ^[3], which locates the failure in the hiring funnel rather than in anything a detection team was ever going to see first.

The volumes describe a production line. Insikt counted at least 22 fabricated personas across multiple clusters, submitting as many as 60 or more applications per day across at least eight job platforms ^[4][5]. At that tempo, covering 1,100 companies is roughly 18 working days of output ^[1], and 1,100 companies spread across 22 personas averages about 50 targets each ^[2]. Ten placements against 1,100 targeted companies is a conversion rate near 0.9 percent ^[3]: unremarkable for a job seeker, and entirely sufficient when applications cost nothing and the persona inventory never runs dry.

The tooling is pointed at recruiters, not at firewalls. Personas were supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service, according to Insikt ^[6]. Operators ran multi-account management browsers and separate Chrome profiles to keep identities apart, with tracking spreadsheets to coordinate applications across them ^[7]. In interviews they used screen recording software alongside AI transcription and chatbot tools to generate answers in real time, sometimes repeating ChatGPT output verbatim ^[8]. Verbatim ChatGPT is a detectable interview artifact, but only if a human is on the call and listening for it.

After the offer, the tells become administrative. Insikt reports that once employed, operators recorded internal meetings at victim organizations and drafted pre-written Google Translate excuses to justify using personal devices and personal bank accounts for work ^[9]. At least two individuals were identified as facilitators who procured and maintained company-issued hardware on the operators' behalf ^[10], and coordination ran over Telegram and Slack ^[11]. Those are payroll, asset-management and IT-logistics signals: laptops shipped to an address that is not the employee's, bank detail changes, a device that never appears from the claimed location.

The targeting is also worth reading as a sector map. Insikt's executive summary lists software and technology, staffing and consulting, and healthcare and biotechnology as the primary sectors ^[12]; its key findings add financial services ^[13]. Staffing and consulting is the entry with leverage against it, because a placement there sits next to other companies' pipelines.

PurpleDelta overlaps with designations other vendors use, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima ^[14]. Earnings are funneled through layers of individual facilitators, shell companies, and money-laundering front companies to finance North Korea's sanctioned military and nuclear programs, per Recorded Future ^[15].

What to watch: Insikt says companies that have observed the indicators in its Appendix A should treat the situation as a potential active compromise and review the employment history and access privileges of matching individuals ^[16]. That is a records exercise owned by HR, talent operations and IT asset management, and it looks backwards at people already onboarded rather than forwards at candidates. Insikt also notes the operators demonstrate a high operational tempo to this day ^[17], so any control built around a single interview round is being tested continuously by a pipeline that only needs 0.9 percent to work.