Jasper Sleet
aka Storm-0287, DPRK IT workers, UNC5267
North Korean workers who use fake identities to get hired remotely as IT staff at foreign companies and send their pay to the regime. Some also steal data or extort the employer after being let go.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Warned that North Korean IT workers use false identities to obtain work, including from Japanese companies — Japan NPA, MOFA, MOF and METI
- Coordinated actions against North Korean remote IT worker schemes funding the regime — US Department of Justice
How they attack
Entry
Getting hired under a fake identity
Like passing a job interview with someone else's ID and a doctored photo, then being handed the office keys.
Inside
Hiding location with remote access
Like having the company laptop kept at a helper's house and operating it from abroad so it looks local.
Goal
Funneling pay to the regime
Like an ordinary paycheck that passes through borrowed accounts until it lands in the regime's coffers.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily