![\"This](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/5aae13541893c425ff371ea1f8cd8d188d0c83b3d934913f9325f09769e723c1.jpeg\")
This Aaron Pierson has applied for jobs in America and Australia.<\/p>\nThe first clue that the neat, carefully spoken man on the Zoom screen was not merely a prospective employee for an Australian tech company but a secret agent for the North Korean regime was his struggle to describe where he lived in New York.<\/p>\n
The man claiming to be Aaron Pierson calmly described how his IT prowess could help the Australian start-up flourish.<\/p>\n
But he hesitated when quizzed about which of New York\u2019s famous five boroughs he claimed to have spent three years in while at university.<\/p>\n
\u201cNew York City\u201d was all he could initially muster. When pushed, he said he had lived on the \u201cwest coast, um, I mean west part of New York\u201d.<\/p>\n
He was equally tongue-tied when asked about major landmarks surrounding his supposed current address in California\u2019s Silicon Valley.<\/p>\n
For a proud American hoping for a start in Australia\u2019s burgeoning artificial intelligence sector, \u201cAaron\u201d was also in the dark about US professional sports.<\/p>\n
He preferred to play soccer with friends, Aaron said nervously.<\/p>\n
Nerves turned to nastiness when asked why he looked nothing like the profile picture used by the real Aaron Pierson, or at least the Pierson who had spent months applying for IT jobs at large multinational firms using the same r\u00e9sum\u00e9 as the man now on the Zoom call.<\/p>\n
This Aaron Pierson has applied for jobs in America and Australia.<\/p>\n
That earlier version of Pierson was a black American detected by Five Eyes security agencies and Australian cyber firm DTEX during efforts to track an extraordinary operation by Kim Jong-un\u2019s security apparatus infiltrating Western companies using an army of undercover operatives posing as stay-at-home and remote IT workers.<\/p>\n
The Aaron Pierson now on the screen was Asian and apparently no longer that job hungry.<\/p>\n
\u201cHey, sorry, I\u2019m not too interested any more,\u201d he said when pushed on this discrepancy over appearance.<\/p>\n
His annoyance and suspicion were justified because \u201cAaron\u201d had stumbled into a trap. The job didn\u2019t exist and he was not the only participant on the Zoom call pretending to be somebody else.<\/p>\n
The man quizzing him online was one of this story\u2019s authors, posing as a cyber and AI industry recruiter.<\/p>\n
The subterfuge was an attempt to catch the North Korean regime in the act at a time when Australia\u2019s spy chief, Mike Burgess<\/a>, says this country is firmly in the sights of a thousands-strong North Korean army of agents posing as remote IT workers.<\/p>\n \u201cThis is a very real concern,\u201d said Burgess, in an exclusive interview with this masthead and 60 Minutes, of an operation the United Nations believes nets North Korea $800 million a year.<\/p>\n Burgess\u2019 agency, ASIO, has identified undercover operatives targeting Australian firms hoping to funnel salaries back to fund Kim Jong-un\u2019s weapons programs<\/a>.<\/p>\n The ingenious operation works partly because Australian firms have failed to counter the emerging problem, which has also potentially exposed these companies and the wider community to risk.<\/p>\n \u201cFor me, that\u2019s why I\u2019m prepared to talk about this as [ASIO] director-general. That\u2019s the same vulnerability that could be used for espionage, foreign interference and the preparation for sabotage, or just purely, \u2018I\u2019m defrauding you to make some money to pay my government\u2019,\u201d Burgess said.<\/p>\n \u201cThe cost is real-world impact on our people and our economy, and that\u2019s why people and companies should care.\u201d<\/p>\n Law enforcement sources confirmed that major banks, including NAB, had been infiltrated, while the Australian Federal Police\u2019s cyber threat teams are assessing intelligence that North Korean agents are already onshore, including a Melbourne University alumnus-turned suspected regime intermediary.<\/p>\n Mohan Koo, founder of cybersecurity company DTEX, said Australian firms were already compromised and the situation might worsen.<\/p>\n \u201cI would say, dozens right now is a pretty safe bet, but this can quite quickly explode,\u201d he said, pointing to the experience of the United States, where firms have unwittingly hired North Korean agents as remote IT workers for a decade.<\/p>\n Last year, the FBI said this North Korean operation was becoming \u201cincreasingly malicious<\/a>\u201d and it publicly urged US companies to strengthen their defences. Now, Burgess and Koo offer the same urgent plea to corporate Australia to overhaul recruitment practices.<\/p>\n \u201cYou\u2019ve got people who are pretending to be someone who can do some coding skills or some form of IT discipline and they\u2019re selling themselves online,\u201d Burgess said.<\/p>\n \u201cThey may well be interviewed online. Of course, they can use artificial intelligence to change their voice and their face. They get the job, they get given access to a system, and they can actually, for the most part, do work that you need them to do. And, of course, you\u2019ve given access to someone who is North Korean and you can\u2019t trust them.\u201d<\/p>\n<\/p>\n Koo said security-lite online recruiting had super-charged the North Korean operation.<\/p>\n \u201cThe advent of COVID meant that every company on the planet basically had to hire remote people,\u201d he said.<\/p>\n \u201cUnless you\u2019re actually seeing someone face to face, how do you guarantee that they are who they say they are?\u201d<\/p>\n While Australia is just waking up to the problem, US agencies have raided and jailed operatives and identified the infiltration of major firms, including Boeing, NBC and Nike.<\/p>\n The highest profile case in America involved an Arizonan woman who was recruited online by a North Korean operative<\/a>.<\/p>\n According to her indictment, Christina Chapman acted as what is known as a \u201claptop farmer\u201d: a person willing to host and operate the computers that companies send to workers after they are hired online under an alias.<\/p>\n More than 300 US firms posted laptops to Chapman, which she duly plugged in and connected to dozens of North Koreans who had landed jobs.<\/p>\n Chapman was jailed for 8\u00bd years, and the prosecutor in the case, United States Attorney for the District of Columbia Jeanine Pirro, described the Arizonan\u2019s offending not only as prolific but as a stark reminder for Australia.<\/p>\n \u201cThis ordinary, nondescript woman was able to pretty much funnel $17 million to North Korea,\u201d Pirro said.<\/p>\n \u201cCountries like Australia are fertile ground, where there is no suspicion, where identities can be stolen or faked, and where these foreign actors are looking to make new inroads.\u201d<\/p>\n Pirro said the real lesson from the Chapman case was how supposedly security-conscious global companies such as Nike could be so easily duped.<\/p>\n \u201cWe had big companies that got caught up in this because they weren\u2019t checking to make sure that the person who was logging on was a person who applied for the job,\u201d Pirro said.<\/p>\n \u201cMost Fortune 500 companies will not admit to that but we had quite a few of them who were willing to do so. And credit and kudos to Nike for saying, \u2018You know what? It happened to us and it could happen to you\u2019.\u201d<\/p>\n If anyone is familiar with this reality, it\u2019s DTEX\u2019s lead investigator, Michael Barnhart.<\/p>\n After the 2001 terrorist attacks on the US, Barnhart served as a US intelligence official alongside the military across the Middle East, combating Islamic extremists. Tattooed and propelled by a seemingly relentless nervous energy, Barnhart describes Kim Jong-un\u2019s online operatives as \u201cso opportunistic, so clever\u201d.<\/p>\n \u201cThey understand how crime works and they use that crime to further nation state goals,\u201d he said.<\/p>\n In Australia, Barnhart\u2019s DTEX office is in Lot Fourteen, the South Australian government\u2019s cyber, AI and technology innovation hub. It may feel as sleepy as the city hosting it, but Lot Fourteen has had its share of scandal.<\/p>\n A few doors down are the offices of one of the space industry hub firms that previously employed consultant Marina Sologub<\/a>, an Irish woman accused by ASIO of working for Russian spy services as they sought to penetrate Australia and other allies among the Five Eyes nations.<\/p>\n From DTEX\u2019s secure bunker, Barnhart fights alongside a group of cyber sleuths he has dubbed the \u201cmisfits\u201d: a small, informal team of former spooks and ex-law enforcement officials, reformed hackers and digital denizens who scour the internet in pursuit of North Korean agents who are posing as IT workers.<\/p>\n These agents are outed by their trail of online bread crumbs left as they juggle multiple jobs using multiple identities and digital platforms. For instance, the same North Korean operative might post different r\u00e9sum\u00e9s online using different names but the same photo.<\/p>\n When a suspected agent is confirmed as a regime operative, the misfits alert the unwitting employer as well as Five Eyes law enforcement and intelligence agencies. The Five Eyes nations<\/a> are Australia, New Zealand, Britain, Canada and the US.<\/p>\n The North Korean operation\u2019s success relies on its scale, leading to inevitable human mistakes.<\/p>\n In selfies snapped to create a fake social media profile, Barnhart\u2019s team discovered an agent who had photographed himself unaware that three of his North Korean accomplices were visible in the background of one of his pictures.<\/p>\n He\u2019s dressed in smart office attire, but his accomplices are wearing the military greens of North Korea\u2019s security apparatus. Closer inspection shows CCTV cameras inside the man\u2019s office, revealing it as a likely military facility and suggesting the selfie-taker and his colleagues are being monitored as they apply for and work their jobs for Western companies.<\/p>\n As his focus has turned from the US to Australia, Barnhart\u2019s sleuthing identified a suspected North Korean IT team using the identity of a supposed Queenslander, going by the first name Kaiden.<\/p>\n A further Google search identified an apparently photoshopped water bill connected to a Sydney house, a document presumably used by the North Koreans to create false Australian identities.<\/p>\n A visit to the house found only a rusting ute on an overgrown front lawn and a confused owner named Wayne who had no idea his address had been stolen by foreign agents.<\/p>\n Once DTEX, Barnhart or his fellow misfits positively identify a North Korean operative, they are covertly targeted, which includes the contents of their laptops. Suddenly, the spies are being spied upon.<\/p>\n During one such infiltration, DTEX uncovered a spreadsheet in which a mid-level North Korean agent kept a running tally of all the countries his team of IT workers were targeting.<\/p>\n The spreadsheet revealed the agent was running about 40 IT workers across 12 teams and that their targets included Australian firms.<\/p>\n \u201c[The firms] don\u2019t realise they have a hand in an adversarial nation\u2019s weapons program, but this absolutely is the smoking gun saying that they do,\u201d Barnhart said.<\/p>\n The search history of another North Korean agent suggests the group is actively targeting an Australian drone and laser company headquartered in Melbourne.<\/p>\n \u2018I\u2019m starting to get a little bit jack of people falling for this.\u2019<\/p>\n ASIO director-general Mike Burgess<\/p>\n While defence industries are an obvious target, another Australian sector under assault is the building and engineering design industry.<\/p>\n Koo, from DTEX, said that if Australian firms were, as he suspected, unwittingly outsourcing engineering or building design tasks to North Korea, the corresponding sabotage risks read like a \u201chorror film\u201d.<\/p>\n Sometimes, compromised companies push back, including firms incredulous that their employee of the month is actually a team of 15 North Koreans stationed in a Pyongyang military facility or a bunker in a Pyongyang-friendly country, such as Russia or China.<\/p>\n \u201cThey have 10, 15 different individuals doing the work of that one employee. Sometimes the work is so good that when we catch them out, the employer says, \u2018No, you can\u2019t fire that individual. They are my best employee\u2019,\u201d Koo said.<\/p>\n Burgess is clearly frustrated that sections of corporate Australia are not taking the threat seriously.<\/p>\n Editor’s pick \u201cI\u2019ve been in this business for a long time now, and I\u2019ve been around cybersecurity for a long time, and to be honest \u2026 I\u2019m starting to get a little bit jack of people falling for this,\u201d he said.<\/p>\n \u201cThis is very real and it\u2019s just another example of how something that is knowable and foreseeable is not being dealt with effectively.\u201d<\/p>\n The threat facing Australian firms is growing as North Korea\u2019s online army receives continuous training and technical support from China.<\/p>\n Job interviews covertly filmed by DTEX reveal interviewees also increasingly rely on AI to alter their appearance and voice.<\/p>\n North Korea also uses AI to scour the internet for online job advertisements; to apply for jobs; and then to correspond with recruiters.<\/p>\n This appeared to be the case when US IT professional \u201cAaron Pierson\u201d applied for a new role with the nascent, and fictitious, Australian AI and cyber company that was created in the hope of catching a North Korean in the act.<\/p>\n On paper, Aaron was an attractive candidate, with a New York University computer science degree and claimed stints at Walmart and Bayer.<\/p>\n But the impressive and detailed education and job history on Aaron\u2019s r\u00e9sum\u00e9 also matched details supplied by job applicants with other companies with different names. Aaron Pierson was also David Ye and David Rose.<\/p>\n Asked to provide details, in the video interview, about his life outside work in California, Aaron\u2019s calm if stilted demeanour slowly crumbled.<\/p>\n He could not even offer up Manhattan or Brooklyn when asked for his favourite New York City location.<\/p>\n The strength of the North Korean operation is Western firms\u2019 insatiable demand for cheaper offshore IT contractors, and its obvious weakness is laid bare with a simple request to attend an in-person induction.<\/p>\n When a meeting is suggested to Aaron to shake his hand, his appetite for the job on offer begins to dissipate.<\/p>\n The journey to Australia is too long, he said.<\/p>\n![\"ASIO](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/54607c61838d37c33e00df737c9e92772a2fb57f.jpeg\")
ASIO director-general Mike Burgess says Australian companies need to wake up to the risk from North Korean infiltration.60 Minutes<\/p>\n![\"DTEX](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/6b6873854bc731380df7520a3e1162b097267a12.jpeg\")
DTEX founder Mohan Koo has identified North Korean operatives targeting Australian companies.Sam Mooy<\/p>\n![\"Some](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/84e57cade8ab824846024bde1622d46815fc2cdf.jpeg\")
Some of the laptops sent to and operated by Christina Chapman.<\/p>\n![\"United](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/d1999be69b24f8c82bfc8a890ad1f957e37ff814.jpeg\")
United States Attorney for the District of Columbia Jeanine Pirro says the system is a threat to large companies.60 Minutes<\/p>\n![\"DTEX](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/5abe5deb64929fd58fe7db6604d026bbc7d4d471.jpeg\")
DTEX investigator Michael Barnhart.60 Minutes<\/p>\n![\"A](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/fc8d72a452ad7d96660d53b29d190bbf03e4123299ba3c3b38a73fda5a45cae8.jpeg\")
A North Korean agent photographed himself unaware that three of his fellow accomplices were visible in the background along with surveillance cameras.<\/p>\n![\"This](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/d9f15052c9ba8b0202c8fa6ef25205685d8386db489665563c71056183502f0a.jpeg\")
This Sydney address was used, without the knowledge of those who live there, in a forged water bill to help create Australian identities.60 Minutes<\/p>\n![\"](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/7fd775521b8ee1cd141a5095469242c3ffd0f47d.jpeg\")
<\/a><\/p>\n
![\"The](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/7bc3cad81bc1ba8ecb972b4c6828aebf45915d6a.jpeg\")
<\/a><\/p>\n![\"Arizona](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/03\/aadca998bd12bc9b2b319c8941d6b0bb5822f4f4.jpeg\")
Arizona woman Christina Chapman was jailed for more than eight years for hosting a \u201claptop farm\u201d for North Korean remote workers. Twitter<\/p>\n