Healthcare and biotechnology ranked among the favorite targets of a North Korean employment-fraud operation that showered more than 1,100 companies with job applications between late 2024 and early 2025, according to Recorded Future’s Insikt Group, which tracks the cluster as PurpleDelta. The group kept about 22 fabricated personas, some built with AI-generated photos, and submitted roughly 60 applications per day across 10 job platforms. Huntress separately documented the healthcare variant: at an Australian company, three employees were unmasked as DPRK workers impersonating Chinese nationals, with investigators pointing to VPN and proxy traffic, forged identity documents, and passport anomalies during onboarding.
The scheme, long confined to IT contractor roles, has widened into sales, marketing, and medical positions. It is also moving money: researchers estimate $1.97M flowed between December 2025 and February 2026 through sanctioned front company Ryongbong General Corporation, and the FBI is investigating a North Korean IT worker who landed contract work at a US federal agency.
For hospitals and health systems, the finding argues for stronger identity checks during recruitment and onboarding, since fraudulent workers who pass interviews can reach clinical systems and patient data before the deception is caught.
