A trove of internal North Korean documents has given the clearest view yet of how Pyongyang covertly embeds software developers in foreign companies to earn hard currency for the regime. The cache—several dozen gigabytes of spreadsheets, chat logs and forged passports—was obtained by independent researcher “SttyK” and unveiled at the Black Hat security conference in Las Vegas. The files show a professionally managed operation divided into a dozen teams of roughly twelve coders each, all overseen by a single “master boss.” Detailed worksheets track job openings, billable hours and receipts, while Slack messages instruct members to log at least 14 working hours a day. United Nations investigators estimate the broader network funnels US$250 million to US$600 million a year to North Korea, with individual workers surrendering about 85 percent of their pay. The leaked data highlights extensive use of U.S. cloud tools—Google, GitHub and Slack—as well as laptop “farms” and hundreds of false or stolen identities. GitHub said it has since suspended three relevant developer accounts; Google and Slack said they enforce sanctions rules and share threat intelligence with law-enforcement partners. The U.S. Treasury has previously warned that proceeds from such activities finance North Korea’s weapons-of-mass-destruction and ballistic-missile programmes. The revelations coincide with fresh reporting by the BBC that Pyongyang is again exporting manual labour on a large scale. South Korean intelligence officials say more than 10,000 North Koreans were dispatched to Russian construction sites last year, and that the total could surpass 50,000 despite a 2019 UN ban. Escapees described 18-hour workdays, constant surveillance and pay as low as US$100–200 a month, underscoring how the regime is widening its overseas labour pipeline to blunt the impact of international sanctions.