Separate investigations have uncovered IT worker personas seeking employment in Germany and Portugal.
DPRK IT workers are obtaining work through various online platforms, including Upwork, Telegram, and Freelancer. Payment was sought through various means, including cryptocurrency, the Wise money transfer service, and Payoneer.
Extortion playbook
Google adds that the previously identified tactic of post-employment extortion attempts by DPRK IT worker crews has ramped up.
“Recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor,” Google researchers reported. “This data included proprietary data and source code for internal projects.”
Previously, DPRK IT workers terminated from their places of employment might seek to obtain references or attempt to get rehired, but law enforcement action and greater awareness has prompted some groups to adopt more aggressive measures, according to Google. North Korean groups have begun to conduct operations within corporate virtualized infrastructure, Google warned in April.
Detection is ‘challenging’
Using chatbots, “potential hires” are perfectly tailoring their resumes, and further leverage AI-created deepfakes to pose as real people.
North Koreans operatives commonly use face-changing software during video interviews or rely on AI assistants to help answer questions in real-time.
Crystal Morin, former intelligence analyst for the US Air Force turned cybersecurity strategist at Sysdig, told CSOonline that North Korea is primarily targeting US government entities, defence contractors, and tech firms hiring IT workers.
“Companies in Europe and other Western nations are also at risk,” according to Morin. “North Korean IT workers are trying to get jobs either for financial reasons — to fund the state’s weapons program — or for cyberespionage.”
Morin added: “In some cases, they may try to get jobs at tech companies in order to steal their intellectual property before using it to create their own knock-off technologies.”
“These are real people with real skills in software development and not always easy to detect,” she warned.
Countermeasures
IT managers and CISOs need to work with their colleagues in human resources to more closely vet applicants. Additional technical controls might also help.
Here’s some suggestions for recommended process improvements:
- Conduct live video-chats with prospective remote-work applicants and ask them about their work projects
- Look for career inconsistencies in resumes or CVs
- Check references by calling the referee to confirm any emailed reference
- Confirm supplied residence address
- Review and strengthen access controls and authentication processes
- Monitor supplied equipment for piggybacking remote access
Post-hire checks need to continue. Employers should be wary of sophisticated use of VPNs or VMs for accessing company system, according to KnowBe4. Use of VoIP numbers and lack of digital footprint for provided contact information are other red flags, the vendor added.
David Feligno, lead technical recruiter at managed services provider Huntress, told CSOonline: “We have a multiple-step process for trying to verify if a background looks too good to be true — meaning is this person stealing someone else’s profile and claiming as their own, or simply lying about their current location. We first check if the candidate has provided a LinkedIn profile that we can review against their current resume. If we find that the profile location does not match the resume — says on resume NYC, but on LinkedIn profile says Poland — we know this is a fake resume.
“If it is the same, did this person just create a LinkedIn profile recently and have no connections or followers?”
Huntress also checks that an applicants’ supplied phone number is valid, as well as running a Google search on them.
“All of the above will save you a great deal of time, and if you see anything that does not match, you know you are dealing with a fake profile, and it happens a lot,” Feligno concluded.
Brian Jack, KnowBe4’s CISO, agrees that fake remote employees and contractors are something every organization needs to worry about, adding: “CISO’s should review the organization’s hiring processes and ensure that their overall risk management practices are inclusive of hiring.”
Hiring teams should be trained to ensure they are checking resumes and references more thoroughly to be sure the person they are interviewing is real and is who they say they are, Jack advises. Best would be to meet candidates in person along with their government-issued ID or using trusted agents, such as background checking firms — especially as use of AI enters into the mix of hiring schemes such as these.
“One thing I like to do as a hiring manager is ask some questions that would be hard to prepare for and hard for an AI to answer on the fly, but easy for a person to talk about if they were who they claim to be,” Jack says.
