IT employees from North Korea are expanding their activities beyond the United States and are increasingly targeting organizations across Europe.
Also known as “IT warriors,” North Koreans hide their true identities and pose as workers based in other countries. They try to get jobs at companies in the US and now in Europe to generate revenue for the regime of the Democratic People’s Republic of Korea (DPRK).
As security researchers from the Google Threat Intelligence Group (GTIG) have found, North Korean IT employees are now "hunting" for jobs at companies in Germany, Portugal, and the United Kingdom.
See also: North Korean hackers “uploaded” spyware to Google Play
"In their efforts to secure these positions, the IT workers used deceptive tactics, falsely claiming nationalities from various countries, including Italy, Japan, Malaysia, Singapore, Ukraine, the United States, and Vietnam. The identities used were a mix of real and fabricated faces," said Jamie Collier, lead threat intelligence advisor at GTIG.
According to the researchers, IT workers in Europe were recruited through various online platforms, including Upwork, Telegram and Freelancer. Payment for their services was facilitated through cryptocurrencies, TransferWise and Payoneer.
Researchers discovered user credentials on European job sites and human capital management platforms linked to North Korean IT worker personas seeking work at German and Portuguese companies. North Korean IT workers have also been linked to several projects in the UK, related to artificial intelligence and blockchain technology, content management system (CMS) development and more.
Another employee targeted multiple European organizations in the government and defense sectors in late 2024 using fabricated references and personas to trick employers into hiring him.
See also: ByBit hack: North Korean hackers have laundered at least $300 million.
" We are increasingly seeing North Korean IT workers infiltrate larger organizations to steal sensitive data and extort money from those businesses ," Michael Barnhart , principal analyst at Mandiant, said recently
«It is also not surprising to see them expanding their operations to Europe to replicate their success, as it is easier to trap citizens who are unfamiliar with their ploy».
IT employees from North Korea: A big risk
The FBI has warned many times about the vast army of North Korean IT workers who take jobs abroad to generate revenue for their country. They do this either through their salaries or through malicious activities against the organizations they work for. The North Korean regime keeps up to 90% of the salaries, generating hundreds of millions each year to fund its weapons programs.
After being discovered and fired, some of these secret North Korean employees used confidential information to blackmail former employers, threatening to leak sensitive information stolen from company systems.
In January, the U.S. Department of Justice indicted two North Korean nationals and three intermediaries for their participation in a multi-year remote work fraud scheme.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In recent years, government agencies in South Korea and Japan have also issued alerts about North Koreans who impersonate people from other countries to secure work as remote IT workers at private companies.
See also: Microsoft: North Korean hackers join Qilin ransomware gang
The issue of cyberattacks and data breaches has become increasingly prevalent in recent years, with hackers constantly finding new ways to infiltrate systems and steal valuable information. The involvement of North Korean IT workers is just one example of the ongoing threat businesses face in today's digital landscape.
Businesses are urged to work with law enforcement agencies to combat these threats and protect themselves from the theft of sensitive data. It is vital for companies to take immediate action to avoid the risk emanating from North Korea. Cybersecurity must be taken seriously in today's digital world.
Source: www.bleepingcomputer.com
