> [!hm-nav] > **![Hayden McKenzie's 007 Minion profile picture](attachments/007-minion.png) [[home|HAYDEN MCKENZIE]]** [[home|Home]] [[research|Research]] [[indicators|Indicators]] [[about|About]] # Daily Life Inside North Korea's IT Worker Compounds > [!hm-meta] > A first-ever look inside a Slack workspace North Korean IT workers use around the clock: life in the Rason compounds, what they eat, the DotA lobbies, the flights home, and the pressure to earn that never lets up. > > Hayden McKenzie · 05 Oct 2026 · Inside a DPRK IT Worker Compound > > [[attachments/daily-life-inside-north-koreas-it-worker-compounds.pdf|Download original PDF ↗]] > **Editor's note.** This report is drawn from an archive of a single Slack workspace used socially by North Korean IT workers. Quotes are reproduced as written, spelling included, and times are Korea Standard Time (UTC+9) unless stated otherwise. Each translation is of my own knowledge and may be subject to small inaccuracies. Employers concerned about North Korean IT workers in their hiring pipeline can reach out directly to **[email protected]**. ## Executive Summary Most reporting on North Korea's IT workers, mine included, focuses on the fraud: the personas, the hosted laptops, and the laundered pay. This report focuses on the people behind it, and what they talk about outside of their daily work. The workspace wasn't created as a work tool. Workers from several compounds used it during and around their shifts to find a game of DotA, trade insults, and talk about food, family, sports, and money. The archive holds **about 2 million messages from 1,236 accounts** and contains material dating further back than one year. ### **Key Insights** - The workspace runs on **U.S. business hours**. Activity peaks at 3 AM Korea time and dips at 7 AM, noon, and 7 PM, which line up with meals. Sunday is almost four times busier than Tuesday. - The workers place themselves in **Rason**, in North Korea's far northeast. They talk about going downtown, flying home to Pyongyang by way of Wonsan, and who will be waiting for them at the taxi station when they land. - They live and work in numbered buildings they call **"bases" or "comets,"** which share a bus and a delivery run, and hold football, volleyball, and table tennis matches between them on weekends. - Most of the archive is about **one game, DotA**, played over the compounds' own network. To join a game, workers often have to switch off **Astrill**, the VPN their work machines run on. - The workspace keeps **North Korea's calendar**. Kim Il Sung's birthday, Victory Day, Party Foundation Day, even North Korean Mother's Day each bring a wave of "happy holiday" messages and all-day "holiday servers." They track U.S. holidays too, because their clients do. ### **Notable Findings** - They eat *injogogi-bap* ("man-made meat rice"), a dish born in North Korea's 1990s famine, along with tofu rice and instant noodles. When one worker lost his account and his colleagues joked they would all go home and eat at his house, he answered: **"we are eating pul juk"**, grass porridge. - To "leave" means a flight or a train home at New Year, and the timing is set by payroll. "24 and 27 have airplane," one worker explained in December 2024, "and 24 is pay date. need to get last payment." He would collect his pay on the 24th, fly on the 27th, and still be home before New Year's. When a colleague said he couldn't afford even a train ticket, the first worker urged him to come anyway and summed up the difference: **"here is jail… home is literally freedom."** - Individuals owe a monthly **"base fee,"** falling short is called *jokja* ("deficit"), and "do work" appears in nearly 6,000 messages. One worker quit DotA altogether until he had earned $3,000 to make up their deficit. - A recruiting post for an AI study group, sent to five channels, told members: **"Our party is counting on us."** - Shutting down a round of teasing in March 2025, an administrator banned the word "girl" and declared **"there is no any girl/women devs here."** The ban lasted fourteen hours, until International Women's Day, when the channel wished "all girl devs" a happy holiday. - The biggest shared goal of 2025 was a trip to the new **Wonsan-Kalma beach resort**, which members started saving for the day it opened. I assess with **high confidence** that the people in this workspace are North Korean, and that the compounds they describe are in the Rason area. They name Rason, Wonsan and Pyongyang as home, price things in North Korean won, eat famine-era North Korean food, observe North Korea's holidays to the day, and write in romanized Korean with Northern spellings. Independent research from DTEX, [*From Payroll to Pyongyang*](https://www.dtex.ai/blog/dprk-it-worker-money-trail/), assesses "RB," the employer they name, as Korea Ryonbong General Corporation, a sanctioned conglomerate. ## The Workspace The first message was posted on March 21, 2024. Activity falls off sharply in late November 2025, when most of the community appears to have moved to a second workspace, and trickles on into 2026. Nearly everything happens in `#general`, and the smaller channels each have a job: | Channel | Messages | Used for | | ------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- | | `#general` | 1.6 mil | Almost everything: DotA lobby calls and host addresses, food, sports, bets, arguments, and the occasional work question | | `#random` | 10,922 | Overflow chatter and more lobby calls | | `#verification-step` | 4,564 | Early on, members posted email addresses here; later, general chat | | `#m2m-history` | 2,579 | One-on-one ("man to man") results, and the bets placed on them | | `#announcement` | 1,624 | `@here` posts, and links to tools such as BeeBEEP, another LAN messenger | | `#discussion` | 1,558 | Technical questions ("Who made Custom AI chatbot LLM before?", "can't use macOS 15.3 in VM") | | `#age` | 1,217 | Age of Empires matches ("who can send me age source?") | | `#base-vs-base`, `#team-match`, `#match-schedule` | 2,494 | Setting up matches between compounds | | `#vote` | 891 | Forming teams and recruiting players | | `#report` | 776 | Complaints about other members and clan feuds | Members also mention a `#memes` channel that was removed from the workspace a while back. Work comes up occasionally, mostly when someone is stuck. In December 2024 one member pasted a Java compiler error and asked, **"who is Java Gosu? how can I resolve this error?"** *Gosu* (고수) is Korean for a master or expert, and it's the workspace's word for anyone who's good at something. Others use the channel to hand off tasks ("Who has experience in wordpress theme/plugin development? I'll give the task") or to find help they don't have in their own team: "I need senior Rust Engineer's help." One request in `#discussion` points straight at the jobs themselves: **"is there anybody who can help me with drug test?"** (February 2025) which asks people for support in finding foreign supporters. | | Workspace | | ---------------------------- | ------------------ | | First message | March 21, 2024 | | Last message | September 17, 2026 | | Messages (including replies) | About 2 million | | Accounts that posted | 1,236 | | Busiest channel | `#general` | | Busiest hour (KST) | 03:00 | | Busiest day | Sunday | Account names are Western and Japanese-style personas, but the display names are their own: KangDo, Pigeon, Smile, Punch, Panda. The most active, **KangDo**, takes his name from the Korean word for "robber" and has posted more than 56,000 messages, three times as many as anyone else. The 1,236 figure overcounts the number of people, because members openly run more than one account ("this is my other account," "this is my new id"). Administrators deactivate accounts for insults ("Sarabi just deactivated by rude words"), so people keep spares: "backup my other account now." A second account also lets someone insult a colleague without signing their name, which is why more than 500 messages call someone a "fake" or demand to know who's behind an account: "if you are man, anounce your real id." ## Where They Are Their location comes out in small details: - **Place.** "did you go to the Rason sinae?" (December 2024) asks whether someone went downtown in Rason. A month later, when a colleague asked what "rs" and "rb" meant, a member explained: "rs includes rb / rb is in rs." RB is their employer, and RS is Rason, where their part of it is based. - **Travel home.** Taking leave, for a holiday or a trip home, means a domestic flight or a short drive. In July 2025 one worker explained the new route home, "RS -> WS -> PY," and back, "PY -> WS -> RS": Rason to Wonsan to Pyongyang. - **Phone numbers.** Numbers give away hometowns. When a member claimed to be from Pyongyang's Pothonggang district ("i am from botong"), a colleague checked his number and caught the lie: "botong is 423????" (February 2025). - **Money.** Bets and groceries are priced in Chinese yuan, which is normal for a border zone. North Korean won turns up too: "1 ma dae is 800 wen," a *ma dae* being a sack. - **Hometowns.** Members name Wonsan, Pyongyang, and Chongjin. | Indicator | Detail | | ------------ | --------------------------------------------------------------------------- | | Place | "Rason sinae" (downtown Rason); "rb is in rs"; flights RS → WS → PY | | Currency | Chinese yuan for bets and food; North Korean won also in use | | Food | *Injogogi-bap*, *dubu-bap*, *pul juk* (grass porridge) | | Language | Romanized Korean with Northern spellings; slogan-style `-hara` imperatives ("join hara"), a written command form common to both Koreas | | Hours | Activity peaks 00:00–05:00 KST, the U.S. business day | | Institutions | *Saenghwal chonghwa*, the weekly self-criticism session | ## The Shift Their workday is the American workday, moved to the middle of the night. Messages build through the evening, **peak between midnight and 5 AM**, and fall off after sunrise. | Hour (KST) | Messages | Note | | ---------- | -------- | ------------------------ | | 03:00 | 106,980 | Busiest hour of the day | | 07:00 | 22,212 | Breakfast | | 12:00 | 19,455 | Lunch, the quietest hour | | 19:00 | 24,895 | Dinner | At 4:33 AM one morning in May 2025, two workers compared schedules: > "it is working time now" / "I can play from 5.30 am" / "it's my schedule" / "everyday" > > "same as me" / "but I have to go jog from 5.30min" Meals break up the night: when a game ends near mealtime, players send each other off with "Bbal Ri BAb MEerkU Ler NA Ga Ra" ("Hurry up and go eat"). Weekends are a different story, with Sunday carrying 420,550 messages to Tuesday's 110,891. ### Days off The workspace keeps North Korea's calendar to the day. On Kim Il Sung's birthday (April 15), Victory Day (July 27, "Winner Day!!!"), Liberation Day (August 15), Youth Day (August 28), the founding of the state (September 9) and of the Party (October 10), International Women's Day (March 8), and North Korean Mother's Day (November 16), the channel fills with "happy holiday" messages and lobbies named for the occasion: "holiday server," "holiday morning server," "3.8 holiday gift server!" Even International Workers' Day gets its own result in `#m2m-history`: "5.1 holiday Jengbu vs Bobo family team match result: 2 : 0. Bobo family is loser." For most, a holiday means a day of DotA: "holiday = day off for us." Anyone still working gets asked why ("why are you working on even holiday?"), and anyone who skips the celebration gets called out. On Liberation Day in 2024, one member challenged a colleague: **"Do not you like our nation-holiday?"** They follow a second calendar too. "Today is US holiday," one member noted on Memorial Day 2025, and another added "and today is UK holiday too." When their clients take a day off, so does the client work. ## The Compounds The workers call their compounds "bases," or sometimes "comets," and give each one a number ("comet5," "base 1"). Base 1 comes up far more than any other. The bases are decently sized, and people place each other by floor: "i am in 6 th floor in base 1," "I am 7floor of base 1 now," "i am 4 base 519 room." Games are sometimes limited to a single floor ("please join only comet1 7th floor"), and in January 2025 one member challenged an entire floor: "let us han pan with floor 6 members in base 1." *Han pan* means one round. The compounds are close enough to share a bus and a delivery run. People send each other chocolate ("can you deliver the choco to base1 or not?"), ship things "by base 4 bus," and plan visits ("I will go to base 1 tomorrow"). Work moves between them too, and it gets passed down at a discount. Members subcontract each other for a fraction of what they quote clients: "Who can do as 25/hr?" one asked in January 2025, adding "My rate is 60," and another offered a colleague "$10/hr task." One member looking for an AI developer at $30 an hour added: "if you are in 3 or 4 comet, we can meet." Each base is also run as its own unit, with a building manager, its own meetings, and group outings. **At least some matches between compounds go through management** ("pls suggest building manager to have match with base 6. we already had one with bae 1 at 1st May"), meetings are called by compound ("its comet 1 meeting time"), and outings are taken together ("All of 3, 4 comets, Did you play well in the sea yesterday?"). Where someone trained matters, too. Asked whether they had "graduated rb school" or come from "PN or HB," a member in base 8 answered: "Base 8 is not RB school." The exchange suggests the employer runs a school of its own, and that each base draws its staff from different places. Some compounds are better equipped than others. In January 2025 one member complained that his building had no chin-up or parallel bars, and another listed what a better-equipped compound had: "chol bong, pyong haeng bong, football, baseball, basketball, badminton, pingpong, billiard." When asked where people could meet privately, one worker said there was "no room like that," then corrected himself: "only karaoke room." ## Games Most of the archive is about one game: *DotA*, a Warcraft III mod more than twenty years old, played over the compounds' own network in lobbies that fill and empty all night. ![[attachments/night-shift-in-rason/dota-match.jpg|A match in progress, v6.85h LoD]] *A match in progress, v6.85h LoD* DotA has its own vocabulary. A lobby is a *sobo*, the Korean pronunciation of "server." A good player is a *gosu*, and a bad one is a *bori*, meaning "barley." *Bori* is the workspace's all-purpose insult, in more than 9,000 messages, for a weak player, a bad play, or anyone being annoying: "according score board, [he] is top bori." The game itself rarely gets its full name. In chat it's usually just *.a* ("dot a"): "go to play .a," "what's your .a name?", "Someone upload .a source to Google Drive please." The shorthand caught on through 2025, and by that summer it had overtaken "DotA" in the channel. Players organize themselves into families. KangDo's calls itself an "empire," with a "boss," a "second boss," "subordinates," and one member who styled himself its *chongtong*, a word for a head of state. Rival cliques feud with it while handing out fake family titles in more than 450 messages: a teammate is "my wife," a junior is "my son." **Anyone who switches sides, or abandons a host's lobby for another, is a *byonjolja* (변절자), a "turncoat" or "renegade" — a politically loaded word for a traitor.** Kick votes are decided with emoji: an axe means "kick him," and it has been used as a reaction more than 8,000 times. The humor borrows from the state as well. In June 2025 one member called players to a game with a line written like a mobilization slogan: "mo yo ra dong mu dul a dota si gan i da!" ("Gather, comrades, it's Dota time!") Clans also ran events. In February 2025, one announced a match with a time, a place, and an audience: ![[attachments/night-shift-in-rason/kango-event.png|"place : Steam Dota2"]] *"place : Steam Dota2"* *Dota 2* on Steam shows up alongside the original from mid-2024 onward ("who can play dota 2?"), but it never replaces local-network *DotA*. Others keep Steam for sports games ("my steam account is for only efootball and fifa25"). ### What They Play - ***DotA.*** The version passed around is *DotA v6.85i LoD*, along with the Warcraft III files needed to run it. Newer builds are announced to everyone, once with a Google Drive link (July 2024). - **Counter-Strike.** About 500 messages call for a "CS server," a hosted lobby to gather players for a match. - **Age of Empires.** `#age` organizes matches between compounds, and installers are passed around the same way DotA's are ("who can send me age source?"). - **Sports games.** eFootball and FIFA, played on Steam or, without it, over Radmin VPN, a free virtual LAN tool. A game starts and ends like any other Warcraft III match. The lobby has ten seats, two teams, and a chat box, where players here type "7" for a space ("who7left?", "after7next7pan"). The match ends on Warcraft III's tan score screen, which ranks every player by hero: <div class="hm-exhibit-row"> <figure style="--hm-ar: 1.4237"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/dota-lobby.jpg" alt='"DotA v6.85i LoD" on a local game'><figcaption>"DotA v6.85i LoD" on a local game</figcaption></figure> <figure style="--hm-ar: 1.5056"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/dota-scores.jpg" alt="The score screen after a match"><figcaption>The score screen after a match</figcaption></figure> </div> ### How They Play Warcraft III can only find games on its own section of the network, and every floor of every base sits on its own section. Workers get around this with **LanCraft**, a small relay tool that lets them join a host by typing in an address. As a result, **more than 160,000 messages are hosts posting their address to fill a lobby**, often dozens of times in a row alongside the number of open seats: "copy and paste on lancraft / 1 left." The most common obstacle is **Astrill**, a commercial VPN widely reported as a marker of North Korean IT workers. It comes up 375 times, almost always as the reason a game won't connect: "turn off astrill and use 3000 port" (May 2024), "Can't create because of Astrill." (June 2024). Occasionally, updates to the compounds' own network software cause similar trouble. **Garena**, which for years was the main way to play DotA online in Southeast Asia, circulates here as a file. A newcomer shared a DotA build with it bundled in ("Garena works on this version," August 2024), and others want it for its hotkey tools. Results are mixed: "kk, here, we can't use garena… I am not sure. anyway the garena doesn't work" (June 2025). One screenshot catches both programs side by side. LanCraft (version 1.01b) is scanning the local network for a server, with its own instructions printed beside it: hosts close LanCraft from the taskbar, and joiners type in the host's IP and start Warcraft. Next to it, Astrill (v3.10) sits signed out at its login screen, with the account's email and password saved and "Start automatically" ticked, so the VPN comes back on the next time the machine starts. ![[attachments/night-shift-in-rason/lancraft-astrill.png|LanCraft and Astrill, open together]] *LanCraft and Astrill, open together* A failed join in March 2025 shows the routine. One player posted Warcraft III's "Unable to join the specified game," the host posted his LanCraft connection, and the checklist that followed was to free up port 3000 and make sure Astrill was off: ![[attachments/night-shift-in-rason/astrill.png|"of course, turned off astril."]] *"of course, turned off astril."* ### Sharing Files Small files go straight into Slack: of the 11,674 uploaded, most are screenshots, alongside the Warcraft III executable, the DotA map, LanCraft, and replays posted to settle arguments. Anything larger goes over **IP Messenger** (IPMsg), a LAN chat and file-transfer program that works without internet access: "please send me via ipmsg." IPMsg doubles as the compounds' directory and complaint line. "If you wanna find anybody, then find his id on IPMSG," one member advised in September 2024, and another threatened to "report [him] to [redacted] via ipmsg broadcast." ### Playing Around The Boss Whether anyone gets to play depends on the boss. Some need permission ("my boss ban me from steam," November 2024). Many play when the boss isn't looking: "When boss isn't here, I can play." Others are watched from the boss's own machine: "my boss is record my screen in his com" (August 2025), "my boss is behind me and watching my screen full time." Colleagues use the bosses as a threat ("i will report him to his boss," June 2025). KangDo asked for a way of "hiddening dota when boss come," and another member summed up the rule in code: ``` if(boss){console.log('work')}else{cosnole.log('play')} ``` Two weeks later KangDo was put in charge of a team and changed his tune: "I have to work because I am boss of team now. If I play on the front, my members will not work." Work and play share one screen. In one player's Task Manager, a DotA match sits on "WAITING FOR OTHER PLAYERS," and lancraft.exe runs in the same list as Slack, Telegram, Cursor, Excel, PowerPoint, and Remote Desktop Connection: ![[attachments/night-shift-in-rason/task-manager.jpg|"WAITING FOR OTHER PLAYERS"]] *"WAITING FOR OTHER PLAYERS"* ### "dota giving me stress" At 4:27 AM on May 20, 2025, one worker announced he was quitting the game until he hit his number, and a colleague pushed back: ![[attachments/night-shift-in-rason/stopped-dota.png|"before earn 3k, I won't play"]] *"before earn 3k, I won't play"* "before earn 3k, I won't play," he wrote. "even if it is weekend. and dota giving me stress. so, I will do real sport. maybe, my boss will like this also." His colleague answered: **"working is important and dota is also important for me.. They are parts of my current living. can't lose one of them."** ## Sports Weekends are for football, volleyball, table tennis, and pool, and these matches get organized in the workspace the same way DotA lobbies do. **Football** is the most popular. Teams look for opponents across compounds ("Who can challenge soccer to my team?", "Who can football team match with us?"), games are played outdoors in the afternoon ("we play football outside from 5pm"), and players rest up for them: "I should save my body for tomorrow's soccer." One worker ranked his priorities in July 2025: **"my first job is dota and second job is football and third job is working."** They follow the professional game too, and a Messi-versus-Ronaldo argument in January 2025 had one member posting an AI-written essay titled "Cristiano Ronaldo: The True GOAT in Football." Some matches even get posters. In December 2025 one member advertised a pickup game on the base 4 pitch, open to anyone, "whether you are team or alone": ![[attachments/night-shift-in-rason/football-poster.png|"Location: Base4 ground"]] *"Location: Base4 ground"* **Volleyball** is played between bases on Sundays. In February 2025 one member posted the same challenge four times in a row: ![[attachments/night-shift-in-rason/volleyball.png|"If you are in 1 base and can match volleyball this sunday, please ping me."]] *"If you are in 1 base and can match volleyball this sunday, please ping me."* KangDo calls himself "a super volleyball man," and lists basketball and taekwondo as his other sports. **Table tennis** usually has money on it. In June 2024 one member threw down a challenge, then put it off for a game of DotA: ![[attachments/night-shift-in-rason/table-tennis.png|"can you dare to play table tennis with me for 100 RMB?"]] *"can you dare to play table tennis with me for 100 RMB?"* Three weeks later he went back to the same opponent and asked whether there was "any table tennis gosu group": "i want to learn from gosu." Another asked for help buying a Yinhe blade, a Chinese brand, and a good teacher gets called *sabu*, or master. **Pool** is played both on a real table and on the computer, and the stakes are usually food: "If you defeated by me, then buy a box of banana. Just 180 yuan" (December 2024). Tennis and badminton come up as well: "Just finished tennis and Pool," one member posted in November 2024. ## The Quota Every worker owes a monthly quota, which they call the base fee (*gi ji bi*, 기지비). It comes up in 135 messages, and the amounts vary by person: "my base fee is 10k monthly" (July 2025), "my base fee is 4k" (November 2025), "maybe your base fee is 3k?" Some answer for a whole group: "you need to earn all gi ji bi for 10 members," one member reminded another in February 2025. Trainees are the exception. "sil sup saeng dont have base fee," one explained: *silseupsaeng* (실습생) are interns. Falling short is called *jokja* (적자), "deficit," and it comes up 186 times. The shortfall doesn't reset at the end of the month; it carries over. "i have 10k jek ja," one worker wrote in July 2025. Another counted "during 3 months jek ja," and a third admitted "i am again jek ja on this month too." The end of the month brings a scramble ("I did month end battle for base fee"), and colleagues sometimes pass the hat: "anyone, please gift base fee to [him]." The deficit follows people into their free time ("i am jokja and can't play," September 2025), and eventually it sends them home. "if i don't get 10k this month, i decided go to home," one worker wrote in July 2025. The same month, a colleague announced another's departure: **"[he] will go home soon / he is jek ja hero / we can't see him anymore."** In August 2025, in the middle of a call to join a lobby, one worker posted a crying emoji. Asked why, he answered, "can't play anymore." He hadn't earned last month's base fee. A colleague offered to cover it if his token's price climbed: "now 12x / if go to 20 x, then I can give you base fee." ![[attachments/night-shift-in-rason/base-fee.png|"didn't earn last month base fee"]] *"didn't earn last month base fee"* "Do work" appears in 5,951 messages. It's the standard scold for anyone caught in a lobby when they should be earning, and it's often the last word in an argument. The quota comes with ideology, too. In March 2025 a member posted the same recruiting message to `#general`, `#random`, `#verification-step`, `#m2m-history`, and `#vote`: ![[attachments/night-shift-in-rason/ai-duty.png|"Our party is counting on us"]] *"Our party is counting on us"* "If we want our country to become an economic powerhouse, we must master Artificial Intelligence," it read. "This is not just an opportunity—it is a duty for those who want to bring success and prosperity to our nation. **Our party is counting on us to advance in technology and innovation.**" How the quota actually gets earned — rented identities, hosted laptops, and purchased accounts — is covered in my previous reporting. ## Food Food talk is some of the most distinctly North Korean material in the archive, and it comes up constantly: in bets, nicknames, insults, and weekend plans. The same dishes come up across hundreds of accounts over two years, in ordinary contexts like lunch, prizes, and complaints about the canteen. | Food | Messages | How it comes up | |---|---|---| | Bulgogi ("fire meat") | 729 | The standard prize and treat | | Instant noodles (*ramyon*) | 344 | Bets and gifts, counted in boxes | | *Injogogi-bap* | 123 | Everyday staple, and an insult | | *Kkochi* (skewers) | 95 | Paid out on lost bets; "kochi parties" | | *Dubu-bap* | 84 | Everyday staple | | *Dangogi-guk* (dog-meat soup) | 16 | Jokes, July 2025 | ### The staples The staple is *injogogi-bap*, "man-made meat rice": strips of soybean pulp, left over after the oil is pressed out, wrapped around rice. There's also *dubu-bap* (fried tofu stuffed with rice) and, when someone can afford it, *nakji sundae* (squid sausage — in the North, *nakji* means squid, the reverse of South Korean usage). Members ask what things cost in it ("$1 = how many InJoBab?"), place bulk orders ("I order injobab 100 gae," a hundred pieces), and remind each other about dinner: "Don't forget injobap this evening." "I ate dububap really at lunch," one wrote in February 2025. In January 2025, KangDo started telling members to rename their accounts after the menu: ![[attachments/night-shift-in-rason/food-names.png|"Choose anyone among following"]] *"Choose anyone among following"* The list reads like a street stall: *injogogi-bap*, tofu rice, *babtugi* (puffed rice), *sundae*, dumpling rice, and octopus sausage. A month later he turned it into a ranking of players: ![[attachments/night-shift-in-rason/food-rank.png|Players ranked by what they eat]] *Players ranked by what they eat* In my previous report, a cell working out of China called its habit of rebuilding banned accounts "injogogi spirit." ### Treats and prizes Bulgogi, translated literally as 불 (fire) plus 고기 (meat), is the reward for winning: "give me fire meat for lovely dong saeng," "his team won your team, so in this week, he will eat bul gogi" (July 2025). In May 2025 one worker offered to pay for a "bulgogi party" if a colleague would organize it. Losing at dice costs skewers ("he lost against me in dice so he should buy kkochi to me"), and one member complained that his team had held "a Kochi party without me." Team matches are bet in boxes of noodles ("ramyon 5 box match"). The snacks say something about supply. Members trade boxes of chocolate between compounds and bring Choco Pies as gifts ("I have Choco Pie for mummy," March 2025), a snack that became a black-market currency in North Korea after South Korean companies handed it out at the Kaesong industrial zone. Someone asks for "maxim coffee," a South Korean instant brand, and at least one smoker sticks to a Chinese brand ("I take only hehua"). ### Eating out At least one compound has its own restaurant, with set hours: "1 base restaurant start from 6PM, right?" (July 2025). KangDo suggested going out for the weekend in January 2025 ("we can go to outdoor restaurant"), and the canteen gets reviewed like any other: "recently eating ugly fish soup, It seems to eat worm" (November 2024). In July 2025, members in `#random` joked about turning a colleague's pet into soup. "I want the dan go gi guk with momo tonight," one wrote, and another asked for an invitation, reasoning that "one pet meat will be enough for 3 men." *Dangogi* ("sweet meat") is the North Korean word for dog meat; in South Korea it's called *gaegogi*. ### "we are eating pul juk" In October 2024, a worker told the channel he had been fired. A colleague told him to bid for new work, which he couldn't do: "no account." "if then, go to home," came the reply. Without an account to apply from, there was no new work to find. His colleagues joked that they would all go home with him and eat at his house. His answer: <div class="hm-exhibit-row"> <figure style="--hm-ar: 0.8607"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/fired-pul-juk-1.png" alt='"no account"'><figcaption>"no account"</figcaption></figure> <figure style="--hm-ar: 0.8634"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/fired-pul-juk-2.png" alt='"we are eating pul juk"'><figcaption>"we are eating pul juk"</figcaption></figure> </div> *Pul juk* is grass porridge, **the famine food of the 1990s, which defectors say returns to the poorest families' tables whenever food runs short.** "it's very delicious," a colleague replied. "I love it." ## Family and Distance Many of the workers are married, and their wives and parents stay home while they live in the compounds. Seeing them depends on work. In March 2025 a colleague asked a worker with no client tasks whether he was struggling to survive. His answer: **"can't go and can't meet my wife."** - **Married, living apart.** "my wife can survie herself and I survive myself. how wonderful family we are." (May 2025) - **Missing home.** "i am really miss family mood." (July 2025) - **Waiting at home.** "my parents are waiting for me." (December 2025) ### Going Home Leave comes at New Year, and it runs on a timetable. In early December 2024, members were already asking each other about tickets ("bought airport ticket?" "by train"). One promised a colleague that once aboard, "you will arrive PY just after 1 hour." The colleague said he would "go with my two legs," then added a song: "I go back to home without earning / I go back to home with empty hands." On December 19, four of them worked out the schedule: ![[attachments/night-shift-in-rason/flight-schedule-1.png|"24 and 27 have airplane"]] *"24 and 27 have airplane"* Flights leave on set days, and the first lines up with payday. "24 and 27 have airplane," one explained, "and 24 is pay date. need to get last payment." Leaving on the 27th, he could still be home before New Year's. <div class="hm-exhibit-row"> <figure style="--hm-ar: 0.9379"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/flight-taxi.png" alt='"2 hours and 30 minutes, i can go home"'><figcaption>"2 hours and 30 minutes, i can go home"</figcaption></figure> <figure style="--hm-ar: 1.2560"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/flight-schedule-2.png" alt='"here is jail"'><figcaption>"here is jail"</figcaption></figure> </div> A colleague who lived closer planned to take a taxi ("2 hours and 30 minutes, i can go home"), because "i can't use airplane because no money." A third said he couldn't afford to go at all, not even by train. The first ended the conversation with a line that sums up the archive: **"here is jail… home is literally freedom."** Ten minutes later, the same worker confessed to a "secret marriage" ("long sad story… similar with Hinata + Naruto"). Asked if his wife would meet him at the airport on the 27th, he answered: "she will wait PY in taxi station." Money shapes the trip in other ways. In February 2025 one worker announced "I will go home next month," then added "because of jokja," the quota shortfall, "so will enjoy for a month." KangDo, planning his own vacation the same month, asked the question everyone asks: "train? or flight?" Going home is a big deal. On July 15, 2025, one worker found out a friend was leaving: ![[attachments/night-shift-in-rason/airplane-route.png|"now airplane route was changed"]] *"now airplane route was changed"* "baba will go to home," he wrote. "its so bad news for me." Another member explained the new route ("RS -> WS -> PY"), and a third posted a sad face with "I miss all lovely bros." Some go further than Pyongyang: "I am in abroad," one member wrote in February 2025. ## Money and the Resort When there's money to spare, some of it goes to weddings and holidays. Colleagues give *bujo*, the traditional cash gift ("Thank you for your bujo to my wedding," May 2025), and one groom-to-be was told to "Earn more for your wedding! So you can buy golden guyutong!" — a golden feeding trough. The biggest shared goal of 2025 was the new Wonsan-Kalma beach resort. When it opened on July 1, the news reached `#general` quickly: <div class="hm-exhibit-row"> <figure style="--hm-ar: 0.8452"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/resort-1.png" alt='"WS-GM opened"'><figcaption>"WS-GM opened"</figcaption></figure> <figure style="--hm-ar: 1.0712"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/resort-2.png" alt='"tent price is 5k to 10k one night"'><figcaption>"tent price is 5k to 10k one night"</figcaption></figure> </div> "WS-GM opened," one member posted, and the prices followed within minutes. Hotel rooms were quoted in dollars, by class ("1st class-220 / 2th class-140 / 3th class-85"), while "other buildings works on our currency," at 200,000 to 300,000 won a night — about $6 to $10 at the summer-2025 market rate of roughly 30,000 won to the dollar, a fraction of the hard-currency room prices. A tent was 5,000 to 10,000. Another member signed off for his shift: **"bye, working time. will work hardly to earn ws-gm travel money."** <div class="hm-exhibit-row"> <figure style="--hm-ar: 0.7903"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/resort-3.png" alt='"will work hardly to earn ws-gm travel money"'><figcaption>"will work hardly to earn ws-gm travel money"</figcaption></figure> <figure style="--hm-ar: 0.8369"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/resort-4.png" alt='"Seagull Hotel"'><figcaption>"Seagull Hotel"</figcaption></figure> </div> Others started planning on the spot. Booking went through a payment app ("use SH wallet and do booking"), with "kind guide and detailed instruction" already uploaded, and the cheapest room at the Seagull Hotel was $85. When a colleague called them "poor guys," one answered: ![[attachments/night-shift-in-rason/resort-5.png|"I'm not such a poor guy"]] *"I'm not such a poor guy"* Two weeks later they were still planning. "let's go together WS - GM," one wrote. "only mans go there?" another asked. "their hotel is for couples." ## Women Women show up in the archive from its first weeks to its last, and the workspace never settled on what to do about them. In April 2024 a new member said she was a female developer and was told to leave. *Jaesu* (재수) means luck, so "Very Jae Su No, if join girl" reads as "it's bad luck if a girl joins." When she tried to organize a Counter-Strike team instead, he answered: "Lol, Girl also playing CS? No Jae Su really." ![[attachments/night-shift-in-rason/jaesu.png|"Very Jae Su No, if join girl"]] *"Very Jae Su No, if join girl"* In March 2025, a round of teasing had members calling each other "grandma" and "sister-in-law." An administrator shut it down, and in the process denied that women were there at all: ![[attachments/night-shift-in-rason/no-girls-rule.png|"there is no any girl/women devs here"]] *"there is no any girl/women devs here"* The rule didn't last a day. Fourteen hours later came March 8, International Women's Day, a public holiday in North Korea, and the channel lit up with "@here all girl devs, happy holiday." One member answered, deadpan: "no girl devs here." The question kept coming back. In May 2025, one worker announced he was going jogging at 5:30 AM "with girl dev." Reminded that he was married, he answered: "but wife isnot here." And on November 23, 2025, someone declared "Female devs can't join here," only for "Girl dev joined" to follow a minute later, and "welcome girl dev" shortly after that. <div class="hm-exhibit-row"> <figure style="--hm-ar: 0.9591"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/slack3.png" alt='"but wife isnot here"'><figcaption>"but wife isnot here"</figcaption></figure> <figure style="--hm-ar: 0.9379"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/slack4.png" alt='"how to solve the jek ja problem… while jogging"'><figcaption>"how to solve the jek ja problem… while jogging"</figcaption></figure> </div> Other women work in the compounds as cooks, barbers, and shop staff. When one worker asked a friend in October 2024 to introduce him to a woman who wasn't a developer, the friend's reply was: "cooker, barber? business girl?" ![[attachments/night-shift-in-rason/slack1.png|"cooker, barber? business girl?"]] *"cooker, barber? business girl?"* Female avatars were a separate fight. "DELETE ALL FEMALE AVATAR!!! THIS IS RULE OF CHANNEL," one member posted in March 2025, and KangDo explained why: "AI girls avatars are no problem, but real photos have to be removed. These make us as dangerous." **A real woman's photo has to be found and downloaded, which leaves a trail on a monitored machine.** The same people defended the women who were actually there: "please don't insult girl devs," and from KangDo, "I don't kick girls." ## Memes Slack doesn't have stickers, so the workers bring their own: a set of cartoon rhino stickers cropped from what appears to be a Telegram chat, timestamp still in the corner. There's one for every mood ("HELLO," "WORK," "DO IT," "miss you"), and the most reposted image of all is a close-up of a doll's face, used as a reaction 63 times. Alongside *bori*, the other standing insult is *pachol* (파철), "scrap iron," which shows up in 364 messages for a slow computer or a bad player. Members also have chatbots write serialized stories starring each other, from a romance ("The Penalty of Love — Part 3: The Vitamin Conspiracy") to a DotA saga that had reached Part 9 by July 2025 ("Demon's Dota Dojo — Training the Next Grumpy Legends"). The workspace's favorite characters are the Minions. Members made their own Minion emoji (a crying Minion used 134 times, an angry one 27), share Minion GIFs and videos, mention them by name in more than 160 messages, and trade cheat sheets for Minion language ("Toy = Baboi"). *Baboi* has turned up as an insult in 26 messages, where it probably doubles as a pun on the Korean *babo* (바보), "fool." The fondness isn't unique to this group: Minion accessories were on display at a state-run women's fashion expo in Pyongyang in 2022, [according to NK News](https://www.nknews.org/2022/11/minions-knockoff-chanel-virtual-mirror-north-korea-holds-womens-fashion-expo/). In July 2025, one member answered a colleague in nothing but Minionese, then posted the translator he'd used: <div class="hm-exhibit-row"> <figure style="--hm-ar: 1.2403"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/minion-baboi.png" alt='"how can you know baboi~?"'><figcaption>"how can you know baboi~?"</figcaption></figure> <figure style="--hm-ar: 1.2787"><img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" data-hm-src="attachments/night-shift-in-rason/minion-bello.png" alt='"is this Tanjania language?"'><figcaption>"is this Tanjania language?"</figcaption></figure> </div> The arguments over who is the worst player never end, and at least one went to an AI search engine for a ruling. Its verdict named the workspace's most active member: ![[attachments/night-shift-in-rason/ai-boriest.png|"The most boriest person in RB's Slack is Kangdo."]] *"The most boriest person in RB's Slack is Kangdo."* ## Discipline North Korean discipline mostly turns up as jokes. In May 2025 a member suggested the group hold its weekly self-criticism session, *saenghwal chonghwa*, **"via google meeting."** On Chuseok in October 2025, the holiday for honoring ancestors, one worker scolded the channel for not hosting a game: "jo sang do mo ru nun nom a!! today is holiday. ppal ri create ha ra." ("You bastard who doesn't even know his ancestors! Today is a holiday. Hurry up and host.") Some rules are about staying hidden. In June 2026, after a message in the channel that wasn't in English, one member asked for it to be deleted and begged the others to "chat only english." His reason came a minute later: ![[attachments/night-shift-in-rason/english-only.png|"we use screentracker in o ur unit"]] *"we use screentracker in o ur unit"* **Screen trackers take periodic screenshots of a worker's desktop.** This one belonged to his own unit, so the screenshots went to his own supervisors, and a message in Korean broke what he called the "net-rule." "that word is so risky," he added. "I'm afraid actually." ## A Common Misconception A common assumption is that North Korean IT workers have little exposure to foreign media. The display names in this workspace say otherwise: **at least 22 accounts are named after *Naruto* characters** (Sasuke, Kakashi, Itachi, Orochimaru, Hokage), and others take their names from *Harry Potter* (Hermione, Voldemort), *One Piece*, *Shrek*, *Kung Fu Panda*, and *Frozen*. The same habit carries into games: the DotA lobby shown under Games seats a "kakashi" next to "GHOST" and "KKangPae," romanized Korean for "gangster." Members argue about Messi and Ronaldo like any other football fans. ## For Employers None of these proves anything on its own. Taken together, and alongside the identity and payment checks covered in my previous reporting, they're worth a closer look. **Timing** - **Working hours.** The compounds are busiest from midnight to 5 AM Korea time, roughly 10 AM to 3 PM Eastern in winter and an hour later in summer. A remote hire whose day starts and stops at exactly those edges is working this shift. - **Fixed breaks.** Meals fall at 7 AM, noon, and 7 PM Korea time, which is about 5–6 PM, 10–11 PM, and 5–6 AM Eastern. Being unreachable at the same times every day, including right at the end of a U.S. workday, fits the pattern. - **Absences.** Leave clusters around New Year, with flights on set days. A contractor who disappears for the last week of December, or goes quiet for a month, may be going home. So may one who is reliably unavailable on North Korean public holidays such as February 16, April 15, September 9, and October 10. **Language** - **Literal translations and slang.** "fire meat" for bulgogi and "eye water" for tears; interjections like "ak," "eng?", "kkk," and "muhaha"; slogan-style commands ending in *hara* ("create ha ra"). - **Words worth searching for.** The workspace's own vocabulary can leak into a work chat, ticket, or commit message: *gosu*, *bori*, *sobo*, *jokja*, "base fee," "do work," "PY" for Pyongyang, and prices in yuan. One word proves nothing; a cluster of them is worth a closer look. - **Formal, careful English.** The workspace bans anything but English because screen trackers watch it, and the same caution shows up in written communication: polished messages, but a different, less fluent voice on a live call. **On the device and network** Company laptops won't carry the games or LAN tools these workers use at home. What crosses over is the access they need to reach the laptop and stay hidden: - **Astrill VPN,** or connections from hosting providers and residential proxies instead of a home ISP. - **Remote access** through AnyDesk, RustDesk, TeamViewer, or Zoom and Webex remote control, especially long sessions at night or on weekends. - **Hardware KVMs** (PiKVM, TinyPilot) and EDID emulators showing up as USB or display devices on an issued laptop. - **A laptop that never sleeps** and is active at the same hours every day, including the hours the worker claims to be offline. **Profile and conversation** - **Avatars and names.** Cartoon and anime avatars, *Naruto* names, and AI-generated faces instead of real photos, which the workers consider safer. - **Personal questions.** The persona has a script for the job, but not for family, hometown, or last weekend. - **Remote-only, camera-shy.** A strong preference for remote work, and reluctance to turn on a camera or meet in person. - **Outsourced checks.** Anything that has to be done in person, such as a drug test, is where a remote worker in Rason needs someone else's help. ## Conclusion None of this excuses the fraud these workers take part in, but it does show who's behind it. They work nights on quotas for an employer that decides where they live and when they go home. They eat soybean-pulp rice, bet boxes of noodles on games, play football on Sundays, and save up for a beach resort. Their jokes borrow the state's mobilization slogans, and their feuds its vocabulary of betrayal. One worker said it best in May 2025: **"working is important and dota is also important for me.. They are parts of my current living."** ### Appendix A: Terms The terms below are the workers' own, except where noted. | Term | Definition | | ----------------------- | -------------------------------------------------------------- | | Base / comet | A compound where workers live and work | | *Gi ji bi* | Base fee: the monthly earnings quota owed by a team | | *Jokja* / *jek ja* (적자) | Deficit; behind on the quota | | "Do work" | The standard scold for gaming instead of earning | | *Sobo* | Game lobby or server (Korean pronunciation of "server") | | *.a* | DotA ("dot a") | | *Gosu* / *bori* | Expert player / weak player ("barley") | | *Pan* / *han pan* | A round / one round of a game | | M2M | "Man to man": a one-on-one match | | *Byonjolja* (변절자) | "Turncoat" or "renegade"; used for players who switch clans | | *Sabu* | Master; a skilled player others learn from | | *Pachol* (파철) | "Scrap iron": a slow computer or a bad player | | LanCraft | Relay tool used to join Warcraft III games across the network | | Astrill | Commercial VPN on the workers' machines; has to be off to play | | IPMsg | IP Messenger, the LAN chat and file-transfer tool | | *Injogogi-bap* | "Man-made meat rice": soybean pulp wrapped around rice | | *Pul juk* | Grass porridge | | *Kkochi* | Skewers; the usual payout on a lost bet | | *Dangogi* | "Sweet meat": the North Korean word for dog meat | | *Bujo* | Cash gift at a wedding or funeral | | *Saenghwal chonghwa* | Weekly self-criticism session | | *Jaesu* | Luck; "no jaesu" means bad luck | | RS / WS / PY | Rason / Wonsan / Pyongyang | | WS-GM | The Wonsan-Kalma beach resort | ### Previous Reporting > [!hm-cited] > McKenzie, Hayden. **“The Women Behind North Korea's IT Worker Operations.”** *Inside a DPRK IT Worker Cell*, 23 Sep. 2026,<br>[haydenmckenzie.com/research/dprk-it-worker-cell-part-one](https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one). > > McKenzie, Hayden. **“North Korea's Desperate Methods of Recruitment.”** *Inside a DPRK IT Worker Operation*, 19 Aug. 2026,<br>[haydenmckenzie.com/research/eleven-stages-five-observed-live](https://haydenmckenzie.com/research/eleven-stages-five-observed-live). > > McKenzie, Hayden. **“Dissecting the Identity Lifecycle.”** *Inside a DPRK IT Worker Operation*, 13 Aug. 2026,<br>[haydenmckenzie.com/research/dprk-it-worker-operation-part-two](https://haydenmckenzie.com/research/dprk-it-worker-operation-part-two). > > McKenzie, Hayden. **“How North Korea Outsources Job Fraud at Scale.”** *Inside a DPRK IT Worker Operation*, 19 May 2026,<br>[haydenmckenzie.com/research/dprk-it-worker-operation-part-one](https://haydenmckenzie.com/research/dprk-it-worker-operation-part-one). > [!hm-footer] > **HAYDEN MCKENZIE** · Independent security researcher > > [[research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [Email ↗](mailto:[email protected]) · [Substack ↗](https://substack.com/@haydenmckenzie) · [[attachments/Hayden-McKenzie-CV.pdf|CV ↗]]