PurpleDelta’s Fraudulent Employment Operations

MITRE Techniques

• [T1036 ] Masquerading – Operators disguised themselves as legitimate workers using fabricated identities and persona management across job platforms (‘maintained at least 22 fabricated personas’ and ‘pose as independent contractors and job-seeking developers’).
• [T1585.001 ] Establish Accounts: Social Media Accounts – They created and used accounts on LinkedIn, GitHub, Medium, Upwork, and other platforms to support fake personas (‘including GitHub, LinkedIn, Medium, Upwork’).
• [T1583.001 ] Acquire Infrastructure: Domains – The group used purchased and operated domains and web infrastructure for recruitment and persona support (‘minicursor[.]com’ and ‘use Hostinger, Namecheap, GoDaddy’).
• [T1583.003 ] Acquire Infrastructure: Virtual Private Server – Infrastructure providers were used to host or support the operation (‘Hostinger, Namecheap, GoDaddy’).
• [T1583.006 ] Acquire Infrastructure: Web Services – They relied on web services for identity, messaging, and operational support (‘Telegram and Slack’ and ‘ChatGPT’).
• [T1585.003 ] Establish Accounts: Social Media Accounts – They used multiple communication and collaboration accounts to coordinate and manage personas (‘Telegram and Slack’ and ‘multiple Google Chrome profiles’).
• [T1566 ] Phishing – The operators used fraudulent recruitment and identity deception to lure organizations and workers into engagement (‘apply to jobs at over 1,100 companies’ and ‘recruiting collaborators’).
• [T1078 ] Valid Accounts – They sought and used legitimate freelancer accounts, company accounts, and borrowed identities to gain access (‘buying US and Ukrainian identities and freelance accounts’ and ‘borrow their legitimate identities and infrastructure’).
• [T1114 ] Email Collection – Internal communications were recorded and monitored during employment (‘recorded internal meetings’ and ‘maintained active email inboxes’).
• [T1027 ] Obfuscated Files or Information – AI-generated photos, custom GPTs, and translation-based excuses were used to obscure true identity and intent (‘AI-generated profile photos’ and ‘custom-configured ChatGPT assistants’).
• [T1056.001 ] Input Capture: Keylogging – Screen recording and live transcription were used to capture interview content and facilitate real-time answering (‘copying and pasting transcribed questions from the interviewer into ChatGPT’).
• [T1125 ] Video Capture – They recorded video calls, interviews, and meetings during operations (‘records all their video calls’ and ‘iTop Screen Recorder’).
• [T1056.001 ] Input Capture: Keylogging – Voice transcription tools captured spoken interview content for AI-assisted responses (‘Krisp and Caption.Ed to record and transcribe voice’).
• [T1219 ] Remote Access Software – Facilitators maintained devices and remote access tools were used to control or access them (‘AnyDesk, Google Chrome Remote Desktop, Jump Desktop, and RealVNC’).
• [T1090 ] Proxy – The operators used proxies and VPNs to mask network origin and manage access (‘IPRoyal, Proxy-Seller’ and ‘Astrill VPN’).
• [T1106 ] Native API – They leveraged platform-native tools and services such as Google Sheets, Chrome profiles, and Google Translate to manage operations (‘maintained detailed Google Sheets’ and ‘used Google Translate’).
• [T1005 ] Data from Local System – Files and artifacts were stored locally on operator devices, including profile photos and persona data (‘stored locally on the operator’s device in a dedicated directory’).
• [T1614 ] System Location Discovery – Operators checked local time and used location clues to align with Pyongyang and China (‘checking the current time in Pyongyang’ and ‘Holidays in China’).
• [T1132 ] Data Encoding – They used Korean keyboard mappings and translated strings to conceal meaning (‘when typed with a Korean keyboard’ and ‘becomes the phrase “my mother” in Korean’).