How To Counter Evolving Cybersecurity Threats: The North Korean IT Worker Edition

"The United States Department of Justice (DOJ) has intensified its nationwide crackdown on schemes involving North Korean information technology (IT) workers who fraudulently obtained employment at U.S. businesses. Over the past few years, the U.S. government issued multiple advisories to detect and combat the North Korean remote IT workers' attempts to infiltrate U.S. businesses, the latest of which came in July this year."

"The North Korean IT worker schemes have coincided with the rise in remote work and are designed to evade the existing U.S. sanctions regime by using remote IT work to fund illicit programs in North Korea, including its weapons program. In some cases, their fraudulent employment enables data extortion and exfiltration of the victim companies' proprietary and sensitive data. Hundreds of companies in the U.S. have unwittingly hired North Korean Remote IT workers."

DOJ enforcement has increased against schemes where North Korean IT workers obtain fraudulent employment at U.S. businesses. The schemes exploit the rise of remote work to bypass U.S. sanctions and to fund illicit North Korean programs, including weapons development. Fraudulent hires have enabled data extortion and exfiltration of proprietary, sensitive information from victim companies. Attackers use stolen identities, fake job-site profiles, and AI-generated deepfakes during interviews to impersonate applicants. Hired workers route laptops to U.S. fronts or "laptop farms" and enable remote access via facilitators. Actors create shell companies with websites and financial accounts to appear legitimate, spanning multiple jurisdictions and prompting reassessment of remote hiring, outsourcing, and cybersecurity practices.

Read at Securitymagazine