I though that’s what it was, too, in which case it’s more like wage theft by the North Korean state. But this talks about insider installation of malware &c. but that might just be corporate cope for having accidentally hired a North Korean and been duped by a deepfake despite a “rigorous” background check.