North KoreaAttributedDPRK stateMixedActive 2019 – 2026Jasper Sleet
Also known asStorm-0287 · UNC5267 · Wagemole · Nickel Tapestry · PurpleDelta
Summary
North Korea's remote IT worker program: operatives, mostly based in China and Russia, use stolen or fabricated identities, AI-assisted personas and US- or Japan-based facilitators running 'laptop farms' to get hired into fully remote developer and IT roles, then send wages to the regime and, in some cases, steal data or extort employers. Microsoft tracks it as Jasper Sleet (formerly Storm-0287, active since at least early 2020), Mandiant as UNC5267, Unit 42 as Wagemole; CrowdStrike's FAMOUS CHOLLIMA covers it together with the Contagious Interview malware operation. On 13 Oct 2026 DOJ announced charges against 14 people over a 2019–July 2025 scheme that placed workers at 70+ US companies (≈$3M revenue) and 'Operation Lonestar Roundup', in which the FBI searched 40+ suspected Texas laptop farms on 21–25 Sep 2026 and seized ~187 devices; CrowdStrike, which helped, saw operatives spoofing device identifiers and hiding RMM tools since May 2026. The Sep 2026 Japan–US–Australia–Germany advisory reports the first laptop farm dismantled in Japan and assesses that some IT workers belong to the 313 General Bureau, alongside WaterPlum/Contagious Interview.
Attribution
Some IT workers sit under the 313 General Bureau
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- Japan NPA, FBI and partners (Government, 2026-09-18)
Some North Korean IT workers operate under the 313 General Bureau - US Department of Justice (Government, 2026-10-13)
Coordinated actions against the North Korean remote IT-worker scheme - Microsoft Threat Intelligence (Research, 2025-06-30)
Tracks North Korea's remote IT-worker programme
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Japan — forged-résumé applications and first laptop farm dismantled in Japan | 2025-05 – 2026 | Japan | Cryptocurrency, Web Development | NPA/FBI joint advisory (2026-09-18) |
| Texas laptop farms — Operation Lonestar Roundup (FBI with CrowdStrike) | 2025-04 – 2026-09 | USA | Aerospace, Energy, Financial Services, Healthcare, Cybersecurity, Defense Engineering | US DOJ (2026-10-13); CrowdStrike (2026-10-13) |
| Jasper Sleet remote-IT-worker infiltration with AI-enhanced personas | 2020 – 2025-06 | Global | Technology | Microsoft Threat Intelligence (2025-06-30) |
| DOJ (N.D. Ohio) — stolen-identity remote hiring at 70+ US companies (Sun Sheng Ming et al.) | 2019 – 2025-07 | USA | Healthcare, Communications, Cyber Support, Retail, Manufacturing | US DOJ (2026-10-13) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Resource Development4 | T1585.001Social Media AccountsT1585.002Email AccountsT1583.003Virtual Private ServerT1588.007Artificial Intelligence |
|---|---|
| Stealth1 | T1684.001Impersonation |
| Command and Control1 | T1219Remote Access Tools |
Infrastructure patterns
- VPNs (notably Astrill), VPSs and proxies hide the workers' location (Microsoft, 2025)
- RMM tools — JumpConnect, TinyPilot, RustDesk, TeamViewer, AnyViewer, AnyDesk (Microsoft, 2025)
- Laptop farms in the job's country, reached via RMM or IP-KVM devices (PiKVM, TinyPilot) (Microsoft, 2025)
Reporting and advisories 5
- US DOJ
Coordinated actions against North Korean remote IT worker schemes (Oct 2026) - CrowdStrike
U.S. Government Disrupts FAMOUS CHOLLIMA Operation - Microsoft Threat Intelligence
Jasper Sleet: North Korean remote IT workers’ evolving tactics - Mandiant
Mitigating the DPRK IT worker threat (UNC5267) - NPA / FBI et al.
Joint advisory: WaterPlum and North Korean IT workers (Sep 2026)