Cybersecurity awareness training company KnowBe4 recently disclosed a concerning incident where a North Korean operative posing as a software engineer successfully bypassed their HR hiring procedures. The operative’s activities, which included attempts to plant malware, were swiftly identified and prevented, ensuring no illegal access or data compromise occurred.

This high level of sophistication in creating a believable cover identity and passing extensive interview and background checks highlights the advanced tactics used by nation-state actors. The incident underscores the increasing sophistication of cyber threats and the need for robust security measures to counteract them.

A North Korean Spy in the Hiring Pool

In a blog post dated July 23, 2024, KnowBe4 revealed the details of this attempted breach, highlighting the high level of sophistication employed by the North Korean attackers. The malicious activity was first detected on July 15, 2024, at 9:55 pm EST when KnowBe4’s Endpoint Detection and Response (EDR) software flagged suspicious activities on the new employee’s Mac workstation.

The operative used a Raspberry Pi to download malware, manipulate session history files, and execute unauthorized software. Prompt intervention by KnowBe4’s Security Operations Center (SOC) contained the threat within 25 minutes, preventing any breach.

The North Korean operative had applied for the software engineer role using a stolen U.S. identity enhanced with AI. The hiring process included four video interviews, where the individual’s appearance matched the AI-enhanced photo on the application, and thorough background checks that failed to detect the deception due to the stolen identity.

Stu Sjouwerman, CEO and President of KnowBe4, described the operation as a well-organized, state-sponsored criminal ring with extensive resources. Once hired, the fake worker requested the workstation be sent to an address that was essentially an “IT mule laptop farm.” From there, the operative used a VPN to access the workstation from North Korea or China, working night shifts to align with U.S. daytime hours. This tactic not only facilitated their employment but positioned them to execute cyber attacks under the guise of legitimate work.

Protect Your Company: How to Detect and Prevent Fake IT Worker Scams

Based on its experience, KnowBe4 offered several recommendations to help companies avoid employing fake IT workers:

• Enhanced Background Checks: Companies should conduct detailed background checks that cross-verify information from multiple sources. Any discrepancies in address, employment history, or date of birth should be thoroughly investigated, rather than glossed over.

• Verify References Independently: Do not rely solely on email references. Instead, make direct phone calls to listed references and use professional networking sites to independently confirm employment history and professional connections.

• Thorough Resume Scanning: Look for career inconsistencies and gaps that might indicate a fake identity. Automated systems should be complemented with manual reviews by experienced HR personnel who can identify potential red flags.

• Geolocation Verification: Ensure that remote IT workers are physically located where they claim to be. Use IP tracking and mandatory check-ins from verified locations to confirm the physical presence of the employee.

• Video Verification: Conduct video interviews and ask detailed questions about their work to verify their expertise and location. Randomly scheduled video calls can also help in ensuring the person is who they claim to be.

• Remote Device Scanning: Regularly scan remote devices to ensure they are not being accessed remotely from unauthorized locations. Implementing multi-factor authentication and endpoint security measures can add additional layers of protection.

• Enhanced Monitoring: Implement advanced monitoring for any suspicious activities or continued attempts to access systems. Use AI-driven analytics to detect anomalies in behavior that might indicate malicious intent.

• Strengthen Access Controls: Review and enhance access control and authentication processes to prevent unauthorized access. Regularly update and audit access permissions to ensure that only necessary personnel have access to sensitive information.

• Security Awareness Training: Provide comprehensive training for employees, including HR teams, to recognize and respond to these tactics. Regular updates and simulated phishing exercises can help keep staff vigilant and aware of the latest threat vectors.

The Wrap

The high level of sophistication in these attacks, combined with the use of AI deepfakes and IT mule laptop farms, presents significant challenges for organizations and their HR teams.

Companies must invest in advanced security measures and remain vigilant to protect their systems from such insidious threats. As cyber espionage tactics continue to evolve, so too must the defenses that safeguard our digital frontiers.

By sharing its experience and insights, KnowBe4 emphasizes the importance of a multi-layered security approach, combining advanced technology, rigorous vetting, and continuous education to combat this new and growing threat.