Ep. 1: Strange Things Are Happening
Episode of To Catch a Thief: North Korea On Our Payroll · June 9, 2026 · 54 min
Nicole Perlroth and cybersecurity experts trace how North Korean operatives secured remote IT jobs at U.S. companies to fund the regime's weapons programs.
Summary
In the season premiere of To Catch a Thief, host Nicole Perlroth introduced the North Korean remote IT worker scheme, in which operatives using fake or stolen identities obtain jobs at Fortune 500 companies, defense contractors and government agencies. The episode opened with the 2022 case investigated by Nisos, whose CEO Ryan LaSalle and analyst Ben Riesenberg described how reused LinkedIn photos, fabricated employers, an absence of data-breach history, redirected laptop shipments and an offshore VPN led them to infrastructure matching FBI indicators for the DPRK.
Former diplomat Jim Lewis gave a history of the Korean peninsula, from Japanese colonization and the 38th parallel through the Korean War, and argued that North Korea's economic stagnation drove it to smuggling, counterfeiting and then hacking. CrowdStrike's Adam Meyers described the regime's 'superdollar' counterfeits and early theft from online games, while former FBI analyst Nick Carlson called North Korean hacking a 'criminal cyber startup.' Perlroth recounted the Sony Pictures hack, the Bangladesh Bank heist and the Bybit theft, and said cybercrime may provide half the regime's funding.
Kevin Mandia, Charles Carmichael, Steve Stone and Michael Barnhart described how pandemic-era remote hiring allowed the scheme to scale, noting that the workers actually do their jobs and operate multiple personas. AWS CISO Amy Herzog explained how keystroke latency and AI models exposed about 1,800 attempts to join Amazon. A pseudonymous staffing-agency security chief, 'Cliff,' recounted an FBI seizure in Arizona, discovering placed operatives, and now flagging 25 to 30 suspect profiles daily. Rob Joyce argued cyber revenue punctures sanctions, and a UN estimate put IT worker revenue at roughly half a billion dollars a year. The episode ended with Nisos realizing a North Korean had interviewed with it.
Chapters
- 0:02
Cold open: the mystery workers
Perlroth and interviewees describe remote hires whose identities and behavior do not add up, revealed to be North Korean operatives.
- 3:57
Host introduction and North Korea's cyber reputation
Perlroth introduces herself and argues North Korea punches above its weight in cyber, with Andrew Scott and John Hultquist adding context.
- 8:26
The Nisos investigation
Nisos traces a former media-company worker through reused LinkedIn photos, fake employers, missing breach data, a redirected laptop and an offshore VPN to the DPRK.
- 19:33
Why North Korea needs the money
Jim Lewis explains sanctions and gives a history of Korea's division and the Korean War.
- 25:55
From counterfeiting to hacking
Lewis and Adam Meyers describe superdollar counterfeiting, online game theft and the shift to cybercrime.
- 29:18
Underestimating a cyber power
Nick Carlson and Perlroth contrast North Korea's cartoonish image with major hacks like Sony, Bangladesh Bank and Bybit.
- 33:06
Remote work and the IT worker boom
Meyers, Mandia, Carmichael and Stone explain how pandemic-era remote hiring let skilled North Korean workers slip in.
- 37:09
Michael Barnhart and the persona game
Barnhart describes North Korea as a cyber syndicate whose workers use many personas and reapply after being fired.
- 39:22
Amazon's detection
Amy Herzog explains how anomalies and keystroke latency exposed a contractor and AI surfaced 1,800 North Korean attempts.
- 42:13
A staffing agency's discovery
Cliff recounts an FBI seizure, finding placed and in-house North Korean workers, and now flagging dozens of suspect profiles daily.
- 49:54
The scale of the revenue
SentinelOne, CrowdStrike and UN figures and Rob Joyce's analysis show how IT work funds the weapons program and undermines sanctions.
- 52:49
Cliffhanger: a North Korean applies to Nisos
Nisos realizes one of the North Koreans interviewed at its own company, setting up the next episode.
Key points
What was said, by whom, with the exact words. Timestamps jump to the moment.
- Andrew Scott
Scott argues Americans discount North Korean cyber sophistication, viewing it as isolated and impoverished when it is highly capable.
“We think of them as impoverished, when in reality, They are incredibly capable”
- Ryan LaSalle
LaSalle says the absence of data-breach exposure is one of the best ways to tell whether a person is real, since virtually everyone real has been breached.
“And so if you haven't, then you haven't existed in a digital life”
- Jim Lewis
Lewis argues that hacking has replaced smuggling and counterfeiting as North Korea's main moneymaker because it is safer, easier and pays as well or better.
“in some ways, hacking's taken their place because hacking, it's safer, it's easier, and it pays as well as not better”
- Nick Carlson
Carlson says the FBI treated North Korea as a low priority compared with Russia and China, even though its hackers are among the best in the world.
“This is, in its heart, it's a tech venture. This is a criminal cyber startup. And these guys are crushing it”
- Adam Meyers
Meyers says the shift to remote work during the pandemic turned gig work into full-time salaried jobs for North Korean operatives.
“the thing that really kicked it into high gear, getting full-time salaried jobs, really came with the push towards remote work”
Listen from 33:41 · Remote work during the COVID-19 pandemic
- Kevin Mandia
Mandia says there is currently no good way to stop the problem, with thousands of workers and COVID providing ideal conditions.
“we don't have a good way to stop this problem right now. We really don't. There's thousands of them”
Listen from 34:40 · Remote work during the COVID-19 pandemic
- Charles Carmichael
Carmichael says most Fortune 500 companies he speaks with have unintentionally hired a North Korean IT worker, and he assumes those that deny it are simply unaware.
“Most of the organizations that I talk to that are Fortune 500 companies say we've unintentionally hired a North Korean IT worker”
- Michael Barnhart
Barnhart argues North Korea is better understood as a cyber syndicate than as a conventional government.
“I think understanding that North Korea is a cyber syndicate and less of an actual government or a nation”
- Michael Barnhart
Barnhart estimates each North Korean IT worker has about seven personas and says companies often have multiple 'workers' who are the same person.
“I'd say for every IT worker, there's probably seven personas attached to it”
- Amy Herzog
Herzog explains that the suspect contractor's round-trip latency was roughly ten times the expected 10 milliseconds, a key signal of a remote VPN connection.
“you would expect someone who's connecting directly to... corporate systems to have maybe a 10 millisecond-ish round trip time, and this was 10 times higher than that”
- Amy Herzog
Herzog concluded from the 1,800 attempts that the effort was organizational in scale rather than an isolated actor.
“One, this is not an individual threat actor or a isolated group. This is an organizational scale effort”
- Steve Stone
Stone says SentinelOne saw more than 300 personas submit over a thousand applications in the first half of 2025.
“At just our company, we have seen more than 300 personas submit more than a thousand applications”
- Nicole Perlroth
Perlroth says a Treasury report found the regime withholds 90% of each worker's salary and a UN panel estimated about half a billion dollars a year from IT workers.
“A treasury report found that the regime withholds 90% of each worker's salary”
- Adam Meyers
Meyers says CrowdStrike identified 700 instances of remote IT workers getting jobs in 2025, which he estimates at about $105 million for the weapons program.
“In 2025, CrowdStrike identified 700 instances of remote IT workers getting jobs at organizations”
People
In the conversation
- Nicole PerlrothFormer New York Times lead cybersecurity reporter, author of This Is How They Tell Me the World Ends, and host of To Catch a Thief
- Cliff (pseudonym)Pseudonymous head of cybersecurity at a large U.S. staffing agency
- Ben RiesenbergNisos analyst and former CIA officer
- Jim LewisFormer diplomat and analyst of cyber conflict
- Adam MeyersHead of counter-adversary operations at CrowdStrike
- Michael BarnhartNation-state insider threat investigator who tracks North Korean hackers and IT workers
- Ryan LaSalleCEO of the human-risk investigations firm Nisos
- Amy HerzogChief information security officer of Amazon Web Services
- Rob JoyceFormer NSA hacking and cybersecurity director
- Charles CarmichaelChief technology officer of Mandiant
- Steve StoneSenior vice president of threat intelligence at SentinelOne
- Nick CarlsonFormer FBI analyst specializing in North Korean hacking
- Andrew ScottFormer U.S. intelligence official who tracked Chinese and North Korean cyber threats
- John HultquistChief analyst at Google Threat Intelligence
- Kevin MandiaFounder of Mandiant and partner at Ballistic Ventures
Discussed
- Kim Jong-unSupreme leader of North Korea, whom Yang portrayed on SNL
- Kim Il-sungFounder of North Korea who launched the 1950 invasion of South Korea
- Kim Jong-namHalf-brother of Kim Jong-un, assassinated at Kuala Lumpur airport in 2017
Topics
From the publisher
A new breed of worker is quietly clocking in across the United States. They’re writing code. Managing your passwords. Training the next generation of AI models. They’re gaining trust. And access. On paper, they’re the dream hire. Skilled. Low maintenance. Always remote and often affordable. And by most accounts, they’re doing the work. But strange things are happening. In a new season of To Catch a Thief , host and former lead cybersecurity and digital espionage reporter for The New York Times , Nicole Perlroth, investigates how North Korean agents are infiltrating the global workforce. How did a nuclear-armed regime worm its way onto the payroll of international companies – and why is it so difficult to get them off? To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People. To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Krissy Clark, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.
Summary, chapters and key points were generated from the episode transcript on September 29, 2026. Quotes are checked word for word against the transcript.