State-backed North Korean agents have significantly evolved their infiltration tactics, incorporating artificial intelligence tools and sophisticated deception methods to infiltrate organizations worldwide.
See also: North Korean hackers attack Ukrainian government agencies
Since 2024, these highly trained agents have refined their fake employment scams, leveraging artificial intelligence for image manipulation, voice alteration software, and professional photo editing to create ever more convincing fake identities.
This operation poses a multifaceted threat, as it not only generates revenue for the North Korean regime in violation of international sanctions, but also facilitates widespread intellectual property theft and potential extortion. The scale of this infiltration campaign is alarming, as over 300 US companies across a range of industries unwittingly employed such workers in 2020–2022.
These workers primarily target the technology, critical industry, and transportation sectors, although they have recently expanded their interest to various industries that offer technology-related positions globally.
Their sophisticated approach involves creating elaborate false identities, accompanied by fake documents, social media , and professional portfolios on platforms like GitHub and LinkedIn.
See also: Hacker tried to breach Kraken platform via job application
Microsoft analysts identified this evolving threat as part of ongoing monitoring of North Korean activity, codenamed “Jasper Sleet,” which was previously known as Storm-0287.
The company took decisive action, suspending 3,000 known Microsoft consumer accounts created by these employees, while strengthening detection capabilities through Microsoft Entra ID Protection and Microsoft Defender XDR.
Recent indictments by the US Department of Justice revealed that just two North Korean nationals and three accomplices managed to extract at least $866,255 in revenue from just ten of the sixty-four US companies they had infiltrated, highlighting the significant financial success of the operation.
The workers operate through a complex ecosystem that includes fully aware accomplices who act as intermediaries and take on tasks such as managing logistics and verifying employment. These intermediaries set up laptop farms in target countries, open bank accounts and – when required – attend meetings in place of the fake workers. The entire operation relies heavily on virtual private networks (VPNs), most notably Astrill VPN, as well as remote monitoring and management tools to maintain the illusion of a local presence.
See also: IT employees from North Korea turn to organizations in Europe
To prevent and detect such cases, it is critical for companies to strengthen their identification processes when hiring remote workers. This includes requiring verifiable ID documents, using real-time facial verification technologies, and conducting video interviews under strict conditions to reduce the possibility of deception through artificial voice or image. At the same time, it is important to carefully review digital presence , such as their LinkedIn or GitHub profiles, for signs of fake activity or inconsistencies.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
