To Catch a Thief: China’s Rise to Cyber Supremacy

All North Korean IT worker schemes hinge on one thing: a willing participant in America. We found one, and knocked on her door.Experts have dubbed some of these Americans “laptop farmers.” The North Koreans call them “facilitators” – people willing to host multiple laptops in their home and happy to not ask too many questions. But identifying these people can be hard: unless you have access to a private Discord channel where North Korean IT workers talk freely among themselves.In Episode 3, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth, goes to Ohio to try to understand how and why anyone would help a hostile, authoritarian regime, launder their true whereabouts, and fuel their nuclear weapons program.To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People.To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Krissy Clark, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.

A new breed of worker is quietly clocking in across the United States. They’re writing code. Managing your passwords. Training the next generation of AI models. They’re gaining trust. And access. On paper, they’re the dream hire. Skilled. Low maintenance. Always remote and often affordable. And by most accounts, they’re doing the work. But strange things are happening. In a new season of To Catch a Thief, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth, investigates how North Korean agents are infiltrating the global workforce. How did a nuclear-armed regime worm its way onto the payroll of international companies – and why is it so difficult to get them off? To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People. To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Krissy Clark, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.

Nicole Perlroth sits down with Nicholas Carlini for an Out of Band conversation on the imminent zero-day surge. Carlini explains what Mythos can already do: find and exploit flaws in some of the world’s most hardened, widely deployed software—with minimal human input. He details what Mythos has already hacked, which now includes most of the operating systems in use. Together, they unpack what happens when these elite capabilities are no longer confined to intelligence agencies and freelance hackers—when AI collapses the barrier to entry and begins to overwhelm bug bounty programs. Perlroth presses Carlini on Anthropic’s decision to hold Mythos back, and reports that unauthorized users may have already accessed it. She also asks the uncomfortable question: will researchers like him, that get advance access to these models, become prime targets for nation-state hackers? Finally, they confront the bigger question: whether defenders have any credible path to regain the advantage in a world where, with enough compute, almost anything can be hacked.

Cyber experts start getting called into electric, water, pipeline, railway, and transportation hubs around the country. Hackers have found a clever way to embed in these systems, using a small, unsuspecting device in everyday Americans’ homes. And once these hackers get in, they’re not dropping the usual malware, or sucking much of any data out. Unlike their predecessors, these hackers are very careful to cover their tracks. It appears they’re just lying in wait. Sleeper cells waiting for marching orders. So what’s the trigger? And what happens if they pull it?

During China’s pseudo-cyber-hiatus, the PRC’s hacking operations get a major overhaul. CCP leadership moves responsibility away from the sloppy, brazen hackers at the People’s Liberation Army to the far more stealthy, and strategic, Ministry of State Security. Gone are the “most polite” hackers in the digital world. Here to stay are the gunslingers – the elite of the elite in their field. In Episode 6, host and former New York Times cybersecurity reporter, Nicole Perlroth lays out what it looked like as China’s hackers went underground… and what we missed in Eastern Europe as they did.

As Chinese hackers continue their raid of American companies, the threat reaches new levels of urgency, not so much for the sophistication of these hackers, but because of the sheer volume of attacks. And yet, victims continue to keep their breaches under wraps, and the government is hamstrung in what they can say because most everything they know about Chinese cyberespionage is classified. Then, the Times’ outing of its own breach, and its Shanghai assailants, gives the White House an opening. The Obama Administration decides to indict the Chinese military hackers responsible for thousands of hacks on American businesses. But the naming-and-shaming only sends China’s hackers further underground. In Episode 4, host and former New York Times cybersecurity reporter, Nicole Perlroth explores China’s hacking talent pipeline and how the PRC shifted tasking for its most sensitive operations from slipshod PLA hackers to high-precision, digital ninjas.

In Episode 3, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth visits a welding shop in rural Wisconsin where Chinese hackers have set up shop in a dusty, back-office server. Hackers are using the welding shop as staging grounds to attack a staggering range of American businesses, including a major American airline, fast-growing Silicon Valley start-ups, law firms and research labs, in search of capitalism’s crown jewels: Intellectual property. Nicole revisits a period that cybersecurity experts now call “the most dangerous time in American history”-- a period in which the blueprints to airplanes, stealth fighter jets, turbines, genetically-modified seeds, oil exploration strategies, even the formula for white paint, were smuggled back to China.

Former NSA Director Keith Alexander called it “the greatest transfer of wealth in history.” Hillary Clinton, FBI Director James Comey and President Barack Obama also sounded the alarm on the biggest heist in human history. In Episode 1, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth, pulls back the curtain on China’s sprawling hacking operations. To combat the “Five Poisons”, or the five groups the Chinese Communist Party deems existential threats, China builds an expansive domestic surveillance apparatus. As these dissidents fled China, China’s state-sponsored hackers followed closely behind, wiring the world for Chinese surveillance and paving the way for Operation Aurora.