From what I've seen in other articles about the same case, it's basically nothing special. The North Korean applies under a false identity that isn't associated with North Korea, and they have (or at least claim to have) relevant education and experience that would make them good fits for roles like programming, then they apply for remote jobs where they can continually work at one job without having to go in and interact with people face to face.

I kind of doubt the problem is being suspected of being an operative, though, so much as ex filtration of corporate secrets and potentially falling afoul of sanctions against North Korea if they continue to employ someone in their company once they have a reasonable suspicion that the person is a North Korean national working under a false identity. They would be helping the North Korean government to maintain a steady inflow of foreign currency that they need, which I'm sure could land them in trouble. Aside from that liability, I would imagine they would beore concerned about company IP and tratedsecrets this employee would have access to being available to the DPRK to do what they will with, as well as others in the government being able to use their credentials to potentially access and compromise systems on the company's network that this employee could access.