To Catch a Thief: China’s Rise to Cyber Supremacy

North Korea has now successfully planted agents in companies over the world. And while businesses are getting better at flagging it, North Koreans still have to meet quota. Cybersecurity experts fear North Koreans will move to monetize their access, and data, beyond the paycheck. That data North Korean IT workers took, the source code they stole — even built in some cases — will come back to haunt these organizations. And it’s not just North Korea anymore. The remote IT worker scheme is now a playbook of its own: Cybercriminals and other nation states have adopted it, some with a reputation for far more destructive attacks.In this final episode, host and former New York Times cybersecurity reporter Nicole Perlroth also confronts how AI is leveling the playing field, and what it means that the one capability that has long eluded North Korea’s hackers — autonomous exploitation — is now within reach.To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People.To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Krissy Clark, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.

It’s been nearly 12 years since North Korea launched its crippling attack on Sony Pictures Entertainment over a Seth Rogen film. Most Americans remember the celebrity leaks, the embarrassing emails, the Hollywood spectacle of it all. What they missed was the playbook: Why simply hack an organization when you can bleed reputations dry? Turn stolen data into psychological warfare. It was a model that would soon echo everywhere from Russian intelligence operations to modern ransomware gangs. But Sony was only the beginning. Host and former The New York Times cybersecurity reporter Nicole Perlroth traces how North Korea evolved from an isolated adversary into one of the most innovative and dangerous cybercriminal enterprises on earth. To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People. To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.

Infiltrating the infiltrators. For the first time ever, host and former lead cybersecurity and digital espionage reporter for The New York Times Nicole Perlroth partners with a team of private investigators as they infiltrate a North Korean worker cell. She uncovers what happens after a security firm hires a man calling himself “Joseph.” By turning the tables on one of the world’s most elusive regimes, investigators gain rare, unprecedented access to their hidden Discord ecosystem: leaderboards tracking job applications, interview evasion tactics, and the disturbing levels of access North Korean workers are getting once inside – including, in one case, at an American nuclear utility. They also get a bizarre window into the human culture inside these cells – from their obsession with Minions to their pool parties and steak dinners outside North Korea. What emerges is not just a portrait of a sanctions-evasion operation, but a rare glimpse into how North Korea’s remote worker armies think, collaborate, and survive from behind the screen. To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People. To Catch a Thief was written and produced by Nicole Perlroth, along with Khrista Rypl, T. J. Raphael, Rebecca Chaisson and Sam Gebauer. Additional thanks to Allie Pinel, Fendall Fulton, Krissy Clark, Cai Lee, Eunice Park and Aimee Machado. Editing and Sound Design by Erica Huang. Art direction and design by Ben Long, Gareth Strange and Sarah Burley at the John & Jane Agency, and support from John Leestma.

To Catch a Thief: North Korea On Our Payroll is a gripping investigative podcast exposing how thousands of North Korean operatives are quietly getting hired inside American companies, funneling millions back to the regime and its nuclear weapons program. Hosted by bestselling author and former New York Times cybersecurity reporter Nicole Perlroth, the series features rare access to insiders and the Americans unknowingly helping power this global operation. To Catch a Thief is co-produced by Nicole Perlroth and Rubrik in partnership with Pod People.

Colonial Pipeline was a warning shot. Now, Chinese hackers are inside the digital guts of hundreds of Colonial equivalents across the U.S.—power, water, transportation, and more. The question isn’t if they’re in. It’s why. And what happens next. Is this digital coercion? A warning to stay out of Taiwan? Is an invasion imminent—and are we ready for the cyber fallout that could come with it? In the final episode of this series, host and former New York Times cybersecurity reporter, Nicole Perlroth, investigates the nightmare scenarios U.S. officials are gaming out behind closed doors. The battlefield is already shifting—tilting toward Beijing. And while China prepares, America’s attack surface only grows. This isn’t just a problem for Washington. The new front line runs through all of us.

The General Manager of an electric and water utility in Littleton, Mass. gets a surprise call from the FBI. At first he suspects the caller is a spammer, but soon he learns the agent is very real. Chinese hackers are lurking deep in his utility’s systems. And his is not the only one. Hundreds of other power, water and pipeline operations across the United States are getting hit. These targets have little to no intelligence value at all. But their potential for sabotage? Enormous. In Episode 7, host and former New York Times cybersecurity reporter, Nicole Perlroth, revisits a hack, more than a decade ago, where the motive was not entirely clear at the time. In hindsight, it was the opening salvo.

Every U.S. administration, dating back to President H.W. Bush has struggled to address the threat of Chinese trade theft. But a growing sense of urgency kicks in as American businesses start hemorrhaging trade secrets and entire product lines start vanishing to Chinese copycats. Just as the Obama Administration is set to do something about it, Edward Snowden shifts the narrative back onto the United States. For years, the U.S. fends off its own accusations of hacking. But then China goes for the mother lode. And creates an opening for Obama to strike a deal with his Chinese counterpart, Xi Jinping. In Episode 5, host and former New York Times cybersecurity reporter, Nicole Perlroth reveals the ins and outs and backroom dealings of the cyber detente nobody saw coming.

For this special live recording of To Catch a Thief at The New York Stock Exchange, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth sits down with those who have been directly targeted by, traced, or directly engaged China’s state-sponsored hackers, diplomatically, or in the cyber domain: Pulitzer Prize winning journalist David Barboza, the National Security Agency’s former Cybersecurity Director Rob Joyce, former Cybersecurity and Infrastructure Security Agency Director Jen Easterly, Jim Lewis, of the Center for Strategic and International Studies and Rubrik CEO Bipul Sinha. They discuss how the Chinese hacking threat has morphed from corporate espionage to insidious attacks on infrastructure, the strategic leverage China hopes to gain with these hacks, how Xi Jinping views Trump 2.0, and what levers the United States can still pull to salvage what’s left of its cyber defense.

Google discloses its hack and points the finger squarely at Beijing, which spells the end for Google’s business ambitions in China. Other victims stay silent, too fearful to offend the gatekeepers to the world’s largest market. Nobody will talk. Until they came for The New York Times.In Episode 2, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth outlines what happened when she learns hackers are inside the Times. Mandiant is called. The malware traces back to a Chinese military unit based in Shanghai. Hackers’ digital crumbs make clear they are after one reporter: David Barboza. Just as he is putting the finishing touches on a massive, years-long investigation on the secret wealth of Chinese leaders and their families. Nicole recounts the behind-the-scenes build-up to the hack that started edging victims into the light.

American companies, whole towns, have been eviscerated by Chinese cyberattacks. But their stories remain untold, even as the stakes get higher and the targets more reckless.To Catch a Thief is a first-of-its-kind, documentary look at China’s rise to cyber supremacy. This podcast charts the evolution of China’s state-sponsored hackers, from their beginnings as “the most polite, mediocre hackers in cyberspace” to the “apex predator” that now haunts America’s critical infrastructure. Host Nicole Perlroth, bestselling author and former lead cybersecurity and digital espionage reporter for The New York Times, interviews those who were victimized, and instrumental in tracking, Chinese cyberattacks as the threat morphed from trade secret theft, to blanket surveillance, to pre-positioning in America’s critical infrastructure. For what purpose? To Catch a Thief interrogates the motives behind it all.