A technology company with more than 3,000 employees hires remote engineers worldwide. imper.ai flagged four candidates with high-confidence North Korean (DPRK) IT worker indicators, and all four were removed from the pipeline before any offer, credentials or access.
- Industry: Technology
- Workforce: 3,000+
- ATS: Greenhouse
- Result: Four candidates blocked, zero access
Challenge
Hiring runs through Greenhouse, with technical interviews over Zoom and Microsoft Teams and system access provisioned after a background check. What that process can’t see is the device and network a candidate operates from: a candidate can present a clean resume, pass a technical assessment and clear a background check while connecting through a multi-hop proxy chain built to hide their location.
Since at least 2022, North Korea has run structured programs that place IT workers in remote jobs to earn money for the regime. A single worker can earn up to $300,000 a year, with up to 90% sent back. FAMOUS CHOLLIMA doubled its fraudulent employment activity in 2025 and remains the most active cluster targeting technology hiring.
We were interviewing candidates who looked legitimate on paper, passed technical screens, and had clean background profiles. The signals imper.ai surfaced (VPN infrastructure, remote access tooling, and network latency mismatch) were not visible in our existing process.
CISO, leading technology company
Solution
imper.ai ran in the background of every interview session, analyzing device, network and identity signals and correlating them across sessions rather than judging each in isolation. Across all four candidates it detected Astrill VPN, AnyDesk running during live interviews, and network latency that couldn’t match a US location: signals that background checks, skills assessments and ID + selfie checks don’t see.
How it works
Candidates have no history with the company, so there is nothing to verify them against. imper.ai analyzes signals at every stage (application, screening, technical interview and offer) and flags patterns across them: a candidate who looks clean at screening but shows Astrill VPN and AnyDesk at the technical interview is flagged. It integrates with Greenhouse and Workday and runs during live sessions on Zoom, Microsoft Teams and Google Meet. Recruiters don’t change their process; they see a risk signal and the correlated case history.
Outcome
- No access provisioned. All four candidates were removed before offers, credentials or onboarding
- Caught at the interview. The signals were invisible to background checks, skills assessments and standard ID verification
- Downstream systems protected. Source code, cloud infrastructure and engineering tools stayed secure
