{"id":2746,"date":"2025-04-14T09:00:00","date_gmt":"2025-04-14T09:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2746"},"modified":"2025-04-14T09:00:00","modified_gmt":"2025-04-14T09:00:00","slug":"how-not-to-hire-a-north-korean-it-spy","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2746","title":{"rendered":"How not to hire a North Korean IT spy"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

CISOs looking for new IT hires\u00a0already struggle with\u00a0talent market shortages<\/a>\u00a0and\u00a0bridging cybersecurity skills gaps<\/a>. But now they face a growing challenge from an unexpected source: sanctions-busting North Korean software developers posing as potential hires.<\/p>\n

North Korea is actively infiltrating Western companies<\/a>\u00a0using skilled IT workers who use fake identities to pose as remote workers with foreign companies, typically but not exclusively in the US.<\/p>\n

These North Korean IT workers use fake identities, often stolen from real US citizens, to apply for freelance contracts or remote positions.<\/p>\n

The schemes are part of illicit revenue generation efforts by the North Korean regime, which faces financial sanctions over its nuclear weapons program, as well as a component of the\u00a0country\u2019s cyberespionage activities<\/a>.<\/p>\n

Recent examples of the trend have included the use of deepfake technologies, extortion scams, and increased expansion into Europe.<\/p>\n

Multimillion-dollar fake worker cell busted<\/h2>\n

The\u00a0US Treasury department first warned about the tactic in 2022<\/a>. Thousands of highly skilled IT workers from North Korea are taking advantage of the demand for software developers to obtain freelance contracts from clients around the world, including in North America, Europe, and East Asia.<\/p>\n

\u201cAlthough DPRK [North Korean] IT workers normally engage in IT work distinct from malicious cyber activity, they have used the privileged access gained as contractors to enable the DPRK\u2019s malicious cyber intrusions,\u201d the Treasury department warned.<\/p>\n

\u201cThese IT workers often rely on their overseas contacts to obtain freelance jobs for them and to interface more directly with customers,\u201d it adds.<\/p>\n

North Korean IT workers present themselves as South Korean, Chinese, Japanese, or Eastern European, and as US-based teleworkers. In some cases, DPRK IT workers further obfuscate their identities by creating arrangements with third-party subcontractors<\/p>\n

In the years since the Treasury department\u2019s warning, examples of the ruse in action are emerging increasingly.<\/p>\n

For example, Christina Chapman, a resident of Arizona, pleaded guilty in February 2025<\/a> to fraud, identity theft, and money laundering charges over an elaborate scheme that enabled North Korean IT workers to pose as US citizens and residents using stolen identities to obtain jobs at more than 300 US companies, generating more than $17 million in illicit revenue for Chapman and North Korea.<\/p>\n

US payment platforms and online job site accounts were abused to secure jobs at more than 300 companies, including a major TV network, a car manufacturer, a Silicon Valley technology firm, and an aerospace company. \u201cSome of these companies were purposely targeted by a group of DPRK IT workers,\u201d according to US prosecutors, who add that two US government agencies were \u201cunsuccessfully targeted.\u201d<\/p>\n

According to a\u00a0DoJ indictment<\/a>, Chapman ran a \u201claptop farm,\u201d hosting the overseas IT workers\u2019 computers inside her home so it appeared that the computers were located in the US. The 49-year-old received and forged payroll checks, and she laundered direct debit payments for salaries through bank accounts under her control. Many of the overseas workers in her cell were from North Korea, according to prosecutors.<\/p>\n

Much of the $17.1 million received from the work was falsely reported to tax authorities under the name of 60 real US citizens whose identities were either stolen or borrowed.<\/p>\n

Job search platform entraps unsuspecting companies<\/h2>\n

Ukrainian national Oleksandr Didenko, 27, of Kyiv, was separately charged over a years-long scheme to create fake accounts at US IT job search platforms and with US-based money service transmitters.<\/p>\n

\u201cDidenko sold the accounts to overseas IT workers, some of whom he believed were North Korean, and the overseas IT workers used the false identities to apply for jobs with unsuspecting companies,\u201d\u00a0according to the DoJ<\/a>.<\/p>\n

Didenko, who was arrested in Poland in May 2024, faces US extradition proceedings. US authorities have seized the upworksell.com domain of Didenko\u2019s company.<\/p>\n

KnowBe4 gets a lesson in security awareness<\/h2>\n

How this type of malfeasance plays out from the perspective of a targeted firm was revealed by security awareness vendor\u00a0KnowBe4\u2019s candid admission in July 2024 that it unknowingly hired a North Korean IT spy<\/a>.<\/p>\n

The new hire was promptly detected after he infected his work laptop with malware before going to ground when the incident was detected and refusing to engage with security response staff.<\/p>\n

The software engineer, hired to join KnowBe4\u2019s internal IT AI team, passed video-based interviews and background checks. The \u201cjob seeker was using a valid but stolen US-based identity.\u201d Crucially, it subsequently emerged, the picture on the application was \u201cenhanced\u201d using AI tools from a stock image photo.<\/p>\n

The new hire had failed to complete his induction process, so he had no access to KnowBe4\u2019s systems; as a result, no data breach occurred. \u201cNo illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems,\u201d according to the vendor, which is treating the whole incident as a \u201clearning experience.\u201d<\/p>\n

\u2018Thousands\u2019 of North Korean IT workers seeking jobs<\/h2>\n

A growing and substantial body of evidence suggests KnowBe4 is but one of many organizations targeted by illicit North Korean IT workers.<\/p>\n

In November 2023 security vendor Palo Alto reported that\u00a0North Korean threat actors are actively seeking employment with organizations based in the US and other parts of the world<\/a>. During an investigation in a cyberespionage campaign, Palo Alto\u2019s researchers discovered a GitHub repository containing fake resumes, job interview question and answers, a scan of a stolen US Permanent Resident Card, and copies of IT job opening posts from US companies, among other resources.<\/p>\n

\u201cResumes from these files indicate targets include a wide range of US companies and freelance job marketplaces,\u201d according to Palo Alto.<\/p>\n

Mandiant, the Google-owned threat intel firm, reported last year that\u00a0\u201cthousands of highly skilled IT workers from North Korea\u201d are hunting work<\/a>.<\/p>\n

\u201cThese workers acquire freelance contracts from clients around the world \u2026 although they mainly engage in legitimate IT work, they have misused their access to enable malicious cyber intrusions carried out by North Korea,\u201d according to Mandiant.<\/p>\n

Email addresses used by Park Jin Hyok, a notorious North Korean cyberspy linked to the development of WannaCry and the infamous $81 million raid on Bangladesh Bank, appeared on job sites prior to Park\u2019s US indictment for cybercrimes. \u201cIn the time between the Sony attack [2014] and the arrest warrant issued, PJH was observed on job seeker platforms alongside [other North Korean] DPRK\u2019s IT workers,\u201d according to Mandiant.<\/p>\n

More recently, CrowdStrike reported that a North Korean group it dubbed \u201cFamous Chollima\u201d infiltrated\u00a0more than 100 companies with imposter IT pros<\/a>. Phony workers from the alleged DPRK-nexus group, whose targets included aerospace, defense, retail, and technology organizations predominantly in the US, performed enough to keep their jobs while attempting to exfiltrate data and\u00a0install legitimate remote monitoring and management (RMM) tools<\/a>\u00a0to enable numerous IP addresses to connect to victims\u2019 systems.<\/p>\n

Suspected North Korean faux IT workers unsuccessfully tried to use deepfake video technology in a job interview with security vendor Exabeam. The ruse was easily detected, but as AI technology evolves such schemes will only become harder to detect, Exabeam CISO Kevin Kirkwood warned.<\/p>\n

Threat intel firm Secureworks noted in its\u00a02024 State of the Threat report<\/a>\u00a0that fake IT worker scams are evolving, as the firm detected multiple attempts by fraudulent workers to demand extortionate payments after the theft of proprietary or sensitive information after they were hired by victim companies.<\/p>\n

Crossing continents<\/h2>\n

North Korean IT worker scams are also expanding into Europe.<\/p>\n

While the US remains a prime target, increased obstacles due to a combination of law enforcement action<\/a> and greater awareness, have prompted scammers to target European businesses, according to research from Google<\/a>.<\/p>\n

For example, suspected DPRK workers have undertaken UK projects in areas such as web development, bot development, content management system (CMS) development, and blockchain technology.<\/p>\n

This indicates a \u201cbroad range of technical expertise, spanning traditional web development to advanced blockchain and AI applications,\u201d according to Google.<\/p>\n

Separate investigations have uncovered IT worker personas seeking employment in Germany and Portugal.<\/p>\n

DPRK are obtaining work through various online platforms, including Upwork, Telegram, and Freelancer. Payment was sought through various means, including cryptocurrency, the TransferWise service, and Payoneer.<\/p>\n

North Korea is using various middlemen to facilitate this illicit trade. Investigation into infrastructure used by a suspected facilitator contained fabricated personas, including resumes listing degrees from Belgrade University in Serbia and residences in Slovakia, as well as instructions for navigating European job sites.<\/p>\n

In addition, contact details for a broker specializing in false passports was found on these systems.<\/p>\n

Extortion playbook<\/h2>\n

Google adds that the previously identified tactic of post-employment extortion attempts by DPRK IT worker crews has ramped up.<\/p>\n

\u201cRecently fired IT workers threatened to release their former employers\u2019 sensitive data or to provide it to a competitor,\u201d Google researchers reported. \u201cThis data included proprietary data and source code for internal projects.\u201d<\/p>\n

Previously, DPRK IT workers terminated from their places of employment might seek to obtain references or attempt to get rehired, but law enforcement action and greater awareness has prompted some groups to adopt more aggressive measures, according to Google.<\/p>\n

Detection is \u2018challenging\u2019<\/h2>\n

Using chatbots, \u201cpotential hires\u201d are perfectly tailoring their resumes, and further leverage AI-created deepfakes to pose as real people.<\/p>\n

Crystal Morin, former intelligence analyst for the US Air Force turned cybersecurity strategist at Sysdig, told CSOonline that North Korea is primarily targeting US government entities, defence contractors, and tech firms hiring IT workers.<\/p>\n

\u201cCompanies in Europe and other Western nations are also at risk,\u201d according to Morin. \u201cNorth Korean IT workers are trying to get jobs either for financial reasons \u2014 to fund the state\u2019s weapons program \u2014 or for cyberespionage.\u201d<\/p>\n

Morin added: \u201cIn some cases, they may try to get jobs at tech companies in order to steal their intellectual property before using it to create their own knock-off technologies.\u201d<\/p>\n

\u201cThese are real people with real skills in software development and not always easy to detect,\u201d she warned.<\/p>\n

Naushad UzZaman, co-founder and CTO of Blackbird.AI, told CSOonline that although the technology to deepfake video in real-time is \u201cnot there yet\u201d advances in the technology are only likely to make life easier for counterfeit job applicants.<\/p>\n

\u201cYou can imagine something like a Snapchat filter that would allow someone to present themselves as someone else,\u201d according to UzZaman. \u201cEven if that happens, you\u2019d likely get glitches in the video that would offer tell-tale signs of interference.\u201d<\/p>\n

Countermeasures<\/h2>\n

IT managers and CISOs need to work with their colleagues in human resources to more closely vet applicants. Additional technical controls might also help.<\/p>\n

Here\u2019s some suggestions for recommended process improvements:<\/p>\n

Conduct live video-chats with prospective remote-work applicants and ask them about their work projects<\/p>\n

Look for career inconsistencies in resumes or CVs<\/p>\n

Check references by calling the referee to confirm any emailed reference<\/p>\n

Confirm supplied residence address<\/p>\n

Review and strengthen access controls and authentication processes<\/p>\n

Monitor supplied equipment for piggybacking remote access<\/p>\n

Post-hire checks need to continue. Employers should be wary of sophisticated use of VPNs or VMs for accessing company system, according to KnowBe4. Use of VoIP numbers and lack of digital footprint for provided contact information are other red flags, the vendor added.<\/p>\n

David Feligno, lead technical recruiter at managed services provider Huntress, told CSOonline: \u201cWe have a multiple-step process for trying to verify if a background looks too good to be true \u2014 meaning is this person stealing someone else\u2019s profile and claiming as their own, or simply lying about their current location. We first check if the candidate has provided a LinkedIn profile that we can review against their current resume. If we find that the profile location does not match the resume \u2014 says on resume NYC, but on LinkedIn profile says Poland \u2014 we know this is a fake resume.<\/p>\n

\u201cIf it is the same, did this person just create a LinkedIn profile recently and have no connections or followers?\u201d<\/p>\n

Huntress also checks that an applicants\u2019 supplied phone number is valid, as well as running a Google search on them.<\/p>\n

\u201cAll of the above will save you a great deal of time, and if you see anything that does not match, you know you are dealing with a fake profile, and it happens a lot,\u201d Feligno concluded.<\/p>\n

Brian Jack, KnowBe4\u2019s CISO, agrees that fake remote employees and contractors are something every organization needs to worry about, adding: \u201cCISO\u2019s should review the organization\u2019s hiring processes and ensure that their overall risk management practices are inclusive of hiring.\u201d<\/p>\n

Hiring teams should be trained to ensure they are checking resumes and references more thoroughly to be sure the person they are interviewing is real and is who they say they are, Jack advises. Best would be to meet candidates in person along with their government-issued ID or using trusted agents, such as background checking firms \u2014 especially as use of AI enters into the mix of hiring schemes such as these.<\/p>\n

\u201cOne thing I like to do as a hiring manager is ask some questions that would be hard to prepare for and hard for an AI to answer on the fly, but easy for a person to talk about if they were who they claim to be,\u201d Jack says.<\/p>\n

[This article was originally published on August 28, 2024, and has been updated to include recent findings and events.]<\/em> <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

CISOs looking for new IT hires\u00a0already struggle with\u00a0talent market shortages\u00a0and\u00a0bridging cybersecurity skills gaps. But now they face a growing challenge from an unexpected source: sanctions-busting North Korean software developers posing as potential hires. North Korea is actively infiltrating Western companies\u00a0using skilled IT workers who use fake identities to pose as remote workers with foreign companies, […]<\/p>\n","protected":false},"author":0,"featured_media":994,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2746","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2746"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2746"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2746\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/994"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2746"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}