Kyle
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Kyle. The attribution is theirs, not this site's.
The photograph the persona submitted with its application, published by KnowBe4 in the cited post. KnowBe4 describes it as an AI-enhanced image in which the applicant's own face was placed over a stock photograph of an unrelated person, and states that four video interviews confirmed the applicant matched it. It shows whoever appeared under this identity, not the United States citizen whose name was used.
Profiles and evidence
The stock photograph KnowBe4 identifies as the starting point for the submitted image, published beside it in the cited post. The man in it is a stock-photography model with no connection to the operation; it is shown only to document how the application picture was produced.
Identifiers attributed to this persona
1 indicator the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Kyle |
alias |
Kyle
alias IT Worker Fraud RESEARCHER POST
Source
-
A given name and a photograph, published by the company that hired the identity. KnowBe4 took on a principal software engineer for its internal IT AI team in July 2024 after four video interviews, positive references, a copy of what appeared to be a government identification card and a clear background check, then shipped a Mac workstation to an address the hire had asked for that appeared nowhere in the application. On 15 July 2024, the evening the machine was received, its endpoint software alerted on attempts to install password-stealing malware and alter session history; the SOC contained the device within twenty-five minutes, and KnowBe4, after sharing what it collected with Mandiant and the FBI, identified the hire as a DPRK IT worker. Its whitepaper states that he called himself Kyle, that the name and identifying details belonged to a real United States citizen and were used without their permission, and that the surname is withheld to protect that person; this entry records only what KnowBe4 published. The identity presented itself as a United States-born citizen of Asian ancestry educated in Hong Kong with prior roles at large United States companies, and KnowBe4 reports that a device running Raspberry Pi OS had been set up on the laptop's local network to reach it as a KVM. A first name on its own settles nothing, and it is recorded because an operator who introduced himself as Kyle to one hiring team will do so to the next.
www.knowbe4.com/hubfs/North-Korean-Fake-Employees-Are-Everywhere-WP_EN-us.pdf — KnowBe4