'We've got a live one.' ‘They are inside our house’ Meet Jo From Palm Beach to China U.S. takes action

North Korea has engaged in a wide-ranging effort to place remote workers at U.S. companies in order to funnel money back to its coffers and, in some cases, steal sensitive information.

Jo, as he came to be known to the cybersecurity experts watching his every move, was a hard worker.

He rose early, usually by 5 a.m. ET, and worked late into the night, often six days a week. Jo juggled three jobs and constantly applied to more — sometimes as many as 50 a day. He needed the money. Always professional, he quickly moved on from rejection and followed up with recruiters whenever there was a lull in communication. His inbox was full of job matches and interview confirmations.

One of those interviews would lead a team of cybersecurity investigators to the inner workings of a vast North Korean employment scheme with national security implications.

On a Tuesday in June, Jo put on his headset and logged on to a call for a hard-to-fill artificial intelligence role with Nisos, a corporate security and investigations company headquartered in Virginia. Jo appeared on screen wearing an orange T-shirt in a beige room. He said he was in Palm Beach Gardens, Florida.

“I heard you guys had, I think, Hurricane George recently,” Magen Gicinto, chief people officer for Nisos, inquired. “How was your house? How was Palm Beach?”