{"id":113201,"date":"2025-10-10T11:07:09","date_gmt":"2025-10-10T11:07:09","guid":{"rendered":"https:\/\/www.europesays.com\/ie\/113201\/"},"modified":"2025-10-10T11:07:09","modified_gmt":"2025-10-10T11:07:09","slug":"north-korean-scammers-are-doing-architectural-design-now","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ie\/113201\/","title":{"rendered":"North Korean Scammers Are Doing Architectural Design Now"},"content":{"rendered":"

\u201cThe plans are being used and being built,\u201d says Michael \u201cBarni\u201d Barnhart, a leading authority in North Korean hacking and cyber threats, who works for insider threat security firm DTEX<\/a>. Along with other DPRK researchers, who call themselves a \u201cMisfit\u201d alliance, Barnhart has seen this cluster of workers conducting architectural work and says similar other efforts have been detected. \u201cThey will do the CAD renderings, they\u2019ll do the drawings,\u201d he says. \u201cIt\u2019s not like a hypothetical\u2014those physical things do exist out there.\u201d<\/p>\n

Barnhart\u2014who previously found North Korean animators appearing to work on Amazon and Max shows<\/a>\u2014says that he has also seen potential front companies set up to help run the operations and provide a veneer of legitimacy. The findings raise questions about the quality of the structural work and concerns about safety, if structures are created in the physical world. \u201cIn some of our investigations, these plans and these products that they\u2019re making for these remodels and renderings, they\u2019re not getting good reviews,\u201d Barnhart says. \u201cWe do have indications that also they\u2019re being hired to do critical infrastructure.\u201d<\/p>\n

One 24-minute long screen recording seen by WIRED shows how the freelance operation could work. In the video, a person signs up to a freelance work website and sets up a new profile where they write that they are a \u201clicensed structural engineer\/architect in the USA.\u201d They pick a profile image from a folder of potentially downloaded files, translate text between English and Korean, and access a Social Security number generator website during the sign-up process.<\/p>\n

When their account is created, the video shows them start to message online requests for work, with one message saying: \u201cI can provide you [sic] permit drawing plan set for your residential home design within a few days.\u201d<\/p>\n

Other screen recordings show the workers having conversations with potential clients, and in at least one instance there is a recording of an online call discussing possible work. The Kela researcher, who asked not be named for security reasons, says it appeared some prospective customers returned to the scammers after likely having work completed. The researchers say some kinds of work appeared to be priced from a few hundred dollars up to around $1,000 per job.<\/p>\n

\u201cThis is an opportunistic nation,\u201d DTEX\u2019s Barnhart says. While many companies have started to figure out that North Korea\u2019s IT workers are often applying for remote tech jobs, using false identities, deepfakes on video calls, and local workers to run their operations, they are consistently changing their approaches. Barnhart says it appears that architectural work has been successful for the alleged DPRK workers and that evidence shows the IT workers program can be more subtle than trying to get hired at companies.<\/p>\n

\u201cThey\u2019re moving to places where we’re not looking,\u201d Barnhart says. \u201cThey’re also doing things like call centers. They’re doing HR and payroll and accounting. Things that are just remote roles and not necessarily remote hires.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"\u201cThe plans are being used and being built,\u201d says Michael \u201cBarni\u201d Barnhart, a leading authority in North Korean…\n","protected":false},"author":2,"featured_media":113202,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[267],"tags":[367,365,362,363,364,715,366,18,117,31845,19,17,30113,31899,12314,983],"class_list":{"0":"post-113201","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-arts-and-design","8":"tag-architecture","9":"tag-arts","10":"tag-arts-and-design","11":"tag-artsanddesign","12":"tag-artsdesign","13":"tag-crime","14":"tag-design","15":"tag-eire","16":"tag-entertainment","17":"tag-github","18":"tag-ie","19":"tag-ireland","20":"tag-north-korea","21":"tag-nuclear","22":"tag-scams","23":"tag-security"},"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/113201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=113201"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/113201\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/113202"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=113201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=113201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=113201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}