(Dragos Condrea via Getty)
IT workers from North Korea are not only deceiving companies into hiring them, but also stealing data from the same employers to use for extortion.
For the past year, the US has been warning the public about the threat of disguised North Korean IT workers out to generate funds for the country’s regime. But new security research shows the same IT workers can sometimes resort to hacking their employer once they’ve been hired.
“In some instances, fraudulent workers demanded ransom payments from their former employers after gaining insider access, a tactic not observed in earlier schemes,” according to SecureWorks, a cybersecurity provider that’s been helping clients investigate the threat.
In the report, SecureWorks noted that one disguised North Korean IT worker stole proprietary data from their employer “almost immediately after starting employment in mid-2024.”
In another case, an employer terminated a contractor due to poor performance. It turned out the same contractor was a North Korean IT worker, who ended up sending a ransom demand. “One of the emails included ZIP archive attachments containing proof of the stolen data, and another demanded a six-figure ransom in cryptocurrency to avoid publication of the stolen documents,” SecureWorks said.
The findings aren’t exactly a surprise, especially since North Korea’s government has been tied to numerous hacks across the globe, including stealing from cryptocurrency exchanges. Still, the research shows that accidentally hiring a North Korean IT worker can lead to serious consequences beyond merely paying out a contractor’s salary.
“This shift significantly changes the risk profile associated with inadvertently hiring North Korean IT workers,” Secureworks’ Director of Threat Intelligence Rafe Pilling said. “No longer are they just after a steady paycheck, they are looking for higher sums, more quickly, through data theft and extortion, from inside the company defenses.”
The report goes on to include tips companies can use to help them fish out disguised North Korean IT contractors. An obvious one is to conduct an in-person interview or through a video call. Still SecureWorks has uncovered evidence that the North Korean IT workers have been trying to use free streaming software that contains a “virtual video clone” feature. “Based on these observations, it is highly likely that the threat group is experimenting with various methods for accommodating companies’ requests to enable video on calls,” SecureWorks added.
The North Korean IT workers have been specifically targeting remote jobs. To access the corporate-issued laptops, they've resorted to hiring local Americans to physically receive and then run the computers from within the US.