Fake North Korean IT workers are rampant: Here’s how to spot the telltale signs a new hire is a hacker

Huntress has uncovered at least five North Korean operatives who have managed to get themselves hired so far this year, using techniques that the firm described as 'genuinely wild'.

Workers linked to the Famous Chollima group applied for jobs at IT, sales, and healthcare companies through normal channels, went through the usual onboarding process, and in some cases even went on to carry out the work as normal, sending their pay back to the North Korean regime.

The findings by Huntress come amidst growing concerns over hackers infiltrating enterprises across the United States and Europe.

Earlier this month, Recorded Future revealed that groups of North Korean IT workers dubbed PurpleDelta had created at least 22 fabricated personas, applying for jobs across a range of recruitment websites and platforms such as LinkedIn and Upwork.

Between them, they were applying for as many as 60 jobs per day. Researchers found they were able to collect high-value intelligence and exfiltrate proprietary data, source code, and internal communications in support of North Korean state objectives.

According to Huntress, there are certain telltale signs that new hires could be covert cyber criminals.

Red flags include the use of VPNs, PiKVM, and Guermok devices, particularly when they are both being used, along with web services and browser extensions associated with screen, audio, and video redirection or recording.

Caught in the act

Researchers observed several red flags, including two ‘different’ new hires whose ID documents were issued by the same police station, one day apart.

Notably, the documents were photographed eight minutes apart on the same iPhone.

Meanwhile, a worker was discovered secretly using a Raspberry Pi-based remote KVM device to control a company laptop from thousands of miles away, before the security software was even installed.

In one example in February, Huntress was contacted by an Australian firm that suspected that three employees were North Korean workers impersonating Chinese individuals.

Huntress found that documents in two of the workers' OneDrive accounts shared a common naming convention, while their passports were supposedly issued in the same place and at the same time.

There were also strong similarities between the energy bills and resident identity cards supplied – and the two workers apparently lived on the same street.

An examination of the infrastructure they were using, including IP addresses, ASNs, geographic access patterns and more, found that the accounts were authenticating with several IP addresses identified to be Astrill VPN nodes.

They were also using IPRoyal Proxy, a legitimate commercial proxy service provider that sells access to IP addresses through which customers can route their internet traffic, as well as WorkTitans B.V.

This is a bulletproof-hosting operation that appears to have been raided by the Fiscal Information and Investigation Service of the Netherlands (FIOD).

Robust identity verification

According to Huntress, the rise of fake IT workers means enterprises need to implement more robust identity verification processes.

"Mitigating the risk of fraudulent workers begins at the interview stage and continues with performing rigorous background checks of new hires prior to onboarding," Huntress advised.

"When in doubt, performing standard background checks, searching the individuals online, and verifying any employment history will help to weed out DPRK workers early in the interview process."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.