Material Security says 27 of 2,429 suspected North Korean IT-worker personas reached onboarding in a year

27 of 2,429 is 1.11 percent, about one in 90 (derived)

Material Security's blog post, dated 10 November 2026, says that over a 12 month window "2,429 distinct suspected DPRK personas made contact" to organisations it monitors, that 1,100 of them reached an interview or a later stage, and that 27 reached onboarding activity. The results page the post links to prints the same three counts. This site worked the ratios out: 27 divided by 2,429 is 1.11 percent, and 2,429 divided by 27 is 89.96, so roughly one in 90 (derived). Neither page prints the percentage or the one in 90 figure, only the counts. The same arithmetic gives 1,100 of 2,429 as 45.3 percent and 27 of 1,100 as 2.45 percent (derived).

What that does not establish. The results page gives one sentence of method: Material matched known DPRK-linked email addresses and IP indicators against hiring activity at the organizations it monitors. Neither page prints the indicator list, says where the word known comes from, or gives a confidence level, so suspected remains the vendor's label. Inference, labelled as such: an email address or an IP address is a link to infrastructure, and the pages do not say whether a match alone made a persona suspected or whether other evidence was needed. The pages also do not say how many organisations Material monitors: the results page calls the 99 organisations contacted in 30 days "Customer environments where at least one persona made contact", so the 2,429 is a count inside an unsized population, which by that wording is Material's customer base (inference), and not a count of the hiring market. Neither page says that any of the 27 received credentials, worked, was paid, or opened a file, and the blog calls those questions the next line of inquiry. The file counts are inventories of what organisations held, not of what anyone took. The pages name no victim organisation and no individual applicant, and this briefing names none.

Vendor interest, once. Material Security sells cloud workspace security for Google Workspace and Microsoft 365, including a use case the page's own menu calls Prevent Data Exposure & Exfiltration, and the results page ends with a pitch to find what an attacker or insider can reach and fix risky access automatically. The pages measure the over-shared files that product category addresses, from Material's own telemetry, so the exposure they count is the problem Material sells protection for.

The funnel, as Material prints it and as this site divides it

Material prints counts for three windows: 12 months, 30 days and one day. The 12 month funnel is 2,429, 1,100 and 27. The results page prints a 30 day funnel with a middle stage: 232 made contact, 66 reached an interview or later stage, 4 reached onboarding. The blog's text gives the 30 day contact, organisation and onboarding counts without the 66. The diagram sets the two funnels side by side. Counts are Material's; every percentage is derived by this site.

Zoom

Reading the two funnels together, with care. In the last 30 days 28.4 percent of those who made contact reached an interview or later (66 of 232), against 45.3 percent over 12 months (derived). Inference, labelled as such: a persona that made contact in the last few days has had little time to reach an interview, so the recent window would be expected to look lower at the later stages; the pages do not say whether this explains the gap. Going the other way, 4 of the 66 reached onboarding, 6.06 percent, against 2.45 percent over 12 months (derived). Those are small counts, the windows overlap, and the pages do not say whether the 30 day personas are among the 2,429, so this site draws no trend. As rates, 1,100 interviews over 12 months is 3.01 a day and 66 over 30 days is 2.20 a day; 2,429 contacts is 6.65 a day and 232 over 30 days is 7.73 a day (all derived, 12 months taken as 365 days). The one-day figures, 22 contacts, two interviews and one onboarding, are a sample of one day that the blog does not date.

What the funnel measures. It measures personas, not people. The blog says the personas have names, résumés and faces and "none of them are real", and neither page says how it knows. The results page adds that "multiple people can operate behind one identity", which cuts the same way: 2,429 is not a count of operators. A persona that Material saw at ten organisations is one persona in the 2,429 and ten appearances in monitored hiring pipelines (inference: the pages say personas appeared at several organisations and give no contact count). So 2,429 is neither the number of applications Material saw nor the number of people behind them.

Material's own pipeline. The results page says "Running the same indicators against Material's own recruiting pipeline revealed DPRK personas there too", and adds that the activity was not limited to large enterprises and that it was not just happening to Material customers. It prints no count for Material's own pipeline, does not say whether it is inside the 2,429, and prints no size data for any organisation, so the claim about enterprises and size has no number behind it on either page. It does mean that at least one of the organisations in Material's view is Material.

The five step scheme, and where the counts stop

The results page describes how it says a fake employee gets inside, in five steps it calls ordinary and built on the same remote work tools every legitimate hire goes through. The table sets each step against what Material counts. The steps are Material's description; the page does not cite a source for them.

Where the counts stop. Material's funnel has stages for contact, interview and onboarding, and none for hired, access or paid (derived by lining the counts up against the steps). The results page then says data theft is not always required: "The goal may be the paycheck itself, with wages routed back to the DPRK regime", and "Some operatives may never exfiltrate data or trigger an obvious security event". That framing matters for what the file inventories mean. If the aim is a salary, the files at the four organisations are risk that exists while the account has access, as the page says, not evidence that anything was taken. The page also says getting hired is only the beginning and that a fake employee can access everything the employee identity is connected to, which is an assertion about what access allows, not a finding about any of the 27.

One persona, many pipelines: the reuse figures

Both pages say "Over the year, 41% of personas appeared at more than one organization." The blog adds that fifteen appeared at ten or more organisations and one at nineteen; the results page prints the same counts and says 19 organizations is the most for a single persona. Neither prints the denominator for the 41 percent. If it is the 2,429, 41 percent is about 996 personas and 15 is 0.62 percent (derived, with that assumption stated). The point is the one in the blog's words: "a wider view can reveal the same identity moving through several hiring pipelines".

The sharper figure sits in the onboarding group. Both pages say 18 of the 27 personas that reached onboarding were also in process at other organizations, and that one was completing onboarding paperwork at one company while pursuing seven others. 18 of 27 is 66.7 percent (derived), against 41 percent for all personas. That reads as a higher reuse rate among those who got furthest, but the two figures may not measure the same thing (appeared at more than one organisation over a year, against in process elsewhere), and 27 is a small group, so this site treats it as a lead and not a finding. The story file for this briefing asked for 15 of 27; the 15 on the pages is a count of personas at ten or more organisations over the year, and neither page says how many of those 15 are among the 27.

Why reuse matters to a defender. Reuse is the one signal that a single employer cannot see alone. The results page says each company sees only its own pipeline and a wider view can reveal the same identity moving through several. The pages do not say which of the reused elements Material matches on beyond the method sentence's email addresses and IP indicators, how it shares what it finds, or whether it warns the other organisations in time. A recruiter, agency or applicant tracking system that sees many employers would be positioned to see it; the pages do not say whether any did.

What the onboarding environments held, as printed

For the last 30 days the blog profiles the four organisations where a suspected persona reached onboarding, using what it calls Material's telemetry. It says that in these profiles "each percentage is the share of that data type shared company-wide or by public link". The results page prints the same four profiles and adds a 12 month total across organisations where a persona reached onboarding. These are inventories of files flagged by type and of how widely they were shared. They are not a record of anything opened, copied or taken by a persona.

Zoom

Correcting a summary this site was handed. A secondary summary relayed to this site ties roughly 15 million source-code files and 130,000 bank or routing files to exposure. On both pages those two figures belong to Organization 1, which the pages describe as the tight one. The 277,000 figure belongs to Organization 2 and is the share of its Social Security number files that were shared widely. This briefing follows the pages.

The 277,000 figure, as a share. 277,000 is 68 percent of the roughly 400,000 Social Security number files at Organization 2 (the post's own percentage). It is one organisation's count. The post's three numbers agree only to within its rounding: 277,000 divided by 68 percent is 407,353, against around 400,000; 71 percent of 345,000 is 244,950, against about 248,000, which is 71.88 percent (all derived). None of that changes the picture, and all of it is why this briefing quotes the post's figures as printed.

What the post infers. After the Organization 2 figures it says that an insider would not have to reach for this data and that "it was already open". That is a statement about what a newly provisioned account at that organisation could open, not a statement that any persona did. Both pages put the test the same way: "The question that decides the risk is access", meaning who can reach the files, how widely they are shared and how much a new account could open without anyone approving it. The blog's next step for each case is to "identify the account, the permissions it received, and any activity in the environment", and it closes the profiles with "Same adversary, very different blast radius", which it attributes largely to how each organisation had managed sharing and access.

Reading the totals. The 12 month figures are rounded totals with no organisation count, no definition of how the files were counted, and no statement of when the inventory was taken (at onboarding or later). Inference, labelled as such: because the four 30 day organisations fall within the last 12 months, a single organisation, Organization 2, may hold more than half of the 700K Social Security number files, which would make the total a picture of one environment more than of the whole set. The pages do not say this.

Suspected, linked, provisioned: labels doing the work of evidence

The pages use several labels for the same population. The blog's subtitle says every possible DPRK persona it found, its body says suspected DPRK personas, and its first line says North Korea-linked fake applicants. The results page's headline and its search description say Material tracked North Korea-linked fake applicants, and 2,429 North Korea-linked fake applicants, without the word suspected; its body says suspected fake identities. The only basis printed is one sentence, the method sentence in the previous sections: known DPRK-linked email addresses and IP indicators matched against hiring activity. A match on infrastructure can be right in every case and still carry no information a reader can check, because the list and its provenance are not printed.

The friendly label that matters most is onboarding. An organisation reading that 27 personas reached onboarding may hear that 27 hostile employees were hired. The pages do not say that. The list includes an offer letter and a background check, both of which can happen before any account exists. What the blog does say, and what this site marks, is that for the 27 the question of whether credentials were issued is open.

What Material states, and what it does not

Where the sources differ

The pages against the summary this site was given. The summary spoke of roughly one in 90; the pages print only the counts, and the ratio is this site's (89.96, derived). The summary put 15 million source-code files and 130,000 bank or routing files among the exposed; the pages attribute them to the closely held Organization 1. This builder did not read the secondary summary; the lead relayed it. The article follows the pages.

Between the two Material pages. First, the blog says "Here is what we observed in three different windows:" and prints two windows in the text; the 30 day window and its 66 middle stage appear on the results page. Second, the blog says Organization 4's financial and credit-card files were shared beyond their owners, while the results page says company-wide or by public link, which is the wording of the profiles' definition. The pages differ and this briefing keeps both. Third, the blog and the results page word the label differently: suspected on the blog, North Korea-linked fake applicants without that word in the results page's headline and description.

Inside the material. The framing says a hire arrives already provisioned and the scheme steps say a hire receives access, while the blog says whether credentials were issued is the open question for the 27. The percentages and counts for Organization 2 agree only within rounding.

The date. The blog's visible date is 10 November 2026. A comment at the top of its page source says the site was last published at 22:50:56 UTC on 9 November 2026; the results page carries the same comment and shows no date. That is a site publication time, not necessarily the post's, and it falls 1 hour 9 minutes before the start of 10 November UTC (derived). This briefing uses 10 November 2026 for the blog and treats the results page as undated.

How this differs from earlier North Korean IT worker briefings on this site

Two earlier briefings cover North Korean IT worker schemes from law enforcement records. One reports the Justice Department's paired Texas searches and Ohio indictment, which covered laptop hosting and an alleged revenue figure. The other reports a guilty plea and a same-day Treasury sanctions action. Both are records of named legal actions against people and operations. A third, on the FBI's FaceStealer warning, is a different scheme, about stolen video, and is not part of this story.

The Material pages differ in kind. They have no charge, plea, sanction, revenue or laptop host. They are one vendor's telemetry on applicant personas at organisations it monitors, with counts at each hiring stage and file inventories at four organisations. Neither page cites any of the law enforcement actions, and none of them states an overlap with Material's personas. What they add is the view from the hiring side: where the personas reach and how widely they reappear. What they lack, relative to those records, is any named actor, any court or agency verification and any loss. The paycheck framing is the one point of contact: Material says wages may be routed back to the DPRK regime, a statement the pages make without citing evidence.

What to do, in order

Material's own advice comes in two halves. It pairs hiring controls with access controls and ends with "The only lasting defense runs on both fronts at once": remove the masks you can at the door, and make sure the ones you miss find little to reach. Its five recommendations are listed first in the checklist below and labelled Material. The six that follow are this site's suggestions, built only from what the pages print; Material does not recommend them.

A note on order. Items 8 and 5 are the same control seen from two sides, and they are the cheapest to start: they depend on your own sharing settings, not on anyone's judgment of a persona. Items 1 to 3 and 11 depend on a decision about who is a persona, which Material makes with an indicator list it does not print.

Technical details

The pages print no indicators of compromise, no email address or IP address list, no detection rules, no queries, no commands, no hashes and no infrastructure. What they print are one method sentence and metrics. They are copied below as printed, with straight quotation marks for the pages' curly ones, and each block says what a defender does with it. Nothing here was visited or probed, and nothing is derived inside a block.

The method sentence. It names the two indicator types, email addresses and IP addresses, and the place they were matched, hiring activity. A defender takes the categories, not a list: your applicant tracking system, your mail logs and the addresses of application and interview sessions are the hiring activity you can match against indicator lists from your own intelligence provider. A match is a lead, and Material prints neither a list nor a confidence level.

Material matched known DPRK-linked email addresses and IP indicators against hiring activity at the organizations it monitors.

The 12 month and one-day counts. Use them as a base rate when you look at your own applicant records: count how many candidates reached each stage and compare, knowing that Material's population and list are not printed, so the comparison is a prompt and not a benchmark.

In the one-year window, 2,429 distinct suspected DPRK personas made contact.
Of those, 1,100 reached an interview or a later stage, and 27 reached onboarding activity, including offer letters, background checks, equipment requests, or first-day IT setup.
Even in the one-day window, 22 personas made contact, two reached an interview or later, and one reached onboarding.

The 30 day funnel. The sentence is from the blog and the stage lines are from the results page. They show the three stages and the organisation counts. Use them to decide how often a hiring review should look at identity signals; neither page gives an end date for the 30 days.

In the last 30 days, 232 suspected DPRK personas made contact with 99 organizations. At 42 of those, at least one moved beyond contact to an interview or offer, and at four, a mask reached onboarding.
STAGE 1 232 Made contact
STAGE 2 66 Reached interview or later stage
STAGE 3 4 Reached onboarding
99 organizations contacted
Customer environments where at least one persona made contact.
42 reached an interview or offer
Organizations where at least one persona got at least that far.

The reuse counts. Use them to justify a record of which recruiters, agencies and requisitions saw each flagged identity, so that a later flag can be matched to earlier contacts.

Over the year, 41% of personas appeared at more than one organization. Fifteen appeared at ten or more, and one appeared at nineteen.
18 of the 27 personas that reached onboarding were also in process at other organizations. One was completing onboarding paperwork at one company while pursuing opportunities at seven others.

The file inventory figures. These are the figures to reproduce in your own environment, with your own sharing reports: how many files holding national identifiers, bank details, source code and private keys exist, and how many are shared company-wide or by public link. Neither page prints a query for any of them; the lines below are its sentences, not a rule.

In the profiles below, each percentage is the share of that data type shared company-wide or by public link.
Organization 1: roughly 15 million files flagged as source code and about 130,000 flagged with bank or routing numbers.
Organization 2: around 400,000 files flagged as containing Social Security numbers, 345,000 with bank or routing numbers, and several million source-code files.
68% of those Social Security files, about 277,000, and 71% of the bank and routing files, about 248,000, were shared company-wide or by public link
Organization 3: about 14 million source-code files, of which roughly 1,900 were shared by public link, readable by anyone with the URL.
Organization 4: roughly 1.5 million source-code files and files flagged as containing private cryptographic keys.

The two wordings for Organization 4. The blog and the results page differ. The first line is from the blog, the second from the results page. Check which definition your own sharing report uses before you compare your numbers with these.

about 21% of its financial files and 17% of its credit-card files were shared beyond their owners.
about 21% of its financial files and 17% of its credit-card files were shared company-wide or by public link.

The 12 month blast radius. The totals across organisations where a persona reached onboarding. Use them as a prompt to total the same four categories across your own environment, and to ask which single repository or drive holds most of each.

Sensitive files across organizations where a persona reached onboarding, last 12 months
95M files containing source code (15M at a single organization)
1.4M financial reports
800K files with bank / routing numbers
700K files with Social Security numbers

What the pages do not print.

Not printed on either saved page: any indicator of compromise (domain, address, hash, file name);
the DPRK-linked email address and IP indicator list; any detection rule or query; any confidence level;
the number of organisations monitored; names or sectors of the organisations; the day of the one-day window;
the type or count of private key files at Organization 4; the number of organisations behind the 12 month totals.

The question the pages leave open

Material says 27 personas reached onboarding, that the question which decides the risk is access, and that the next question for each case is what access was given. So the question for any organisation that hired remote engineers this year is the one the pages cannot answer for you: if a new joiner's account were hostile from the first day, which company-wide or public-link files with identifiers would it already be able to open, and who would have to approve that?

Key facts