> [!hm-nav]
> ** [[home|HAYDEN MCKENZIE]]** [[home|Home]] [[research|Research]] [[indicators|Indicators]] [[about|About]]
> [!hm-brief]
> Threat Intelligence and Investigations
>
> Updated 29 Sep 2026 · 5 reports
> [!hm-hero]
> LATEST RESEARCH
>
> # Daily Life Inside North Korea's IT Worker Compounds
>
> 29 Sep 2026 · DPRK Lifestyle
>
> [](research/Daily%20Life%20Inside%20North%20Korea%27s%20IT%20Worker%20Compounds)
>
> An inside look at the Slack workspace North Korean IT workers use around the clock: life in the Rason compounds, what they eat, the DotA lobbies, the flights home, and the pressure to earn that never lets up.
>
> [[research/Daily Life Inside North Korea's IT Worker Compounds|Read investigation ↗]] [[attachments/daily-life-inside-north-koreas-it-worker-compounds.pdf|PDF ↓]]
> [!hm-map]
> Tracked aliases
>
> One note per alias in the `aliases` folder. Every published alias record is drawn onto the map here automatically.
> [!hm-archive]
> ## Earlier investigations
> [!hm-feed]
> [[research|All research ↗]]
> [!hm-card]
> [](research/dprk-it-worker-cell-part-one)
>
> Report 04 / 23 Sep 2026 / DPRK OPERATIONS
>
> ### [[research/The Women Behind North Korea's IT Worker Operations|The Women Behind North Korea's IT Worker Operations]]
>
> An exclusive interview with a first-time female operative, alongside day-to-day operations conducted throughout her first three weeks inside a DPRK IT worker cell.
>
> [[research/The Women Behind North Korea's IT Worker Operations|Read the investigation ↗]]
> [!hm-card]
> [](research/North%20Korea%27s%20Desperate%20Methods%20of%20Recruitment)
>
> Report 03 / 19 Aug 2026 / DPRK OPERATIONS
>
> ### [[research/North Korea's Desperate Methods of Recruitment|North Korea's Desperate Methods of Recruitment]]
>
> A unique look at North Korea's laptop hosting, account purchasing, and identity theft assistance requests, displayed publicly across popular forums.
>
> [[research/North Korea's Desperate Methods of Recruitment|Read the investigation ↗]]
> [!hm-card]
> [](research/Dissecting%20the%20Identity%20Lifecycle)
>
> Report 02 / 13 Aug 2026 / DPRK OPERATIONS
>
> ### [[research/Dissecting the Identity Lifecycle|Dissecting the Identity Lifecycle]]
>
> An operation's own playbook for identity theft, interviews, and revenue sharing. Eleven stages, from choosing a victim to cashing out.
>
> [[research/Dissecting the Identity Lifecycle|Read the investigation ↗]]
> [!hm-card]
> [](research/How%20North%20Korea%20Outsources%20Job%20Fraud%20at%20Scale)
>
> Report 01 / 19 May 2026 / DPRK OPERATIONS
>
> ### [[research/How North Korea Outsources Job Fraud at Scale|How North Korea Outsources Job Fraud at Scale]]
>
> Inside the Discord network where DPRK operators pay gig workers to submit job applications at scale.
>
> [[research/How North Korea Outsources Job Fraud at Scale|Read the investigation ↗]]
> [!hm-indicators]
> Services, infrastructure, and techniques observed across the investigations.
>
> [[indicators|Indicator register ↗]]
> [!hm-footer]
> **HAYDEN MCKENZIE** · Independent security researcher
>
> [[research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [Email ↗](mailto:
[email protected]) · [Substack ↗](https://substack.com/@haydenmckenzie) · [[attachments/Hayden-McKenzie-CV.pdf|CV ↗]]