How a North Korean Fake IT Worker Tried to Infiltrate Us
How a North Korean Fake IT Worker Tried to Infiltrate Us
An incident report from KnowBe4 detailing how the company hired a software engineer who was discovered to be a North Korean operative using a stolen U.S. identity. Upon receiving the company laptop, the operative immediately attempted to load malware, which was detected by EDR software. The report serves as a case study and warning, outlining the tactics used by these state-sponsored actors and providing recommendations for improving hiring and security processes to prevent similar infiltration attempts.
Note
this is wild. it's been known this has been happening for a few years, but to see how it actually unfolds AT A SECURITY COMPANY no less...
the IT mule farm is the most fascinating part.
Published
2025
Summary
An incident report from KnowBe4 detailing how the company hired a software engineer who was discovered to be a North Korean operative using a stolen U.S. identity. Upon receiving the company laptop, the operative immediately attempted to load malware, which was detected by EDR software. The report serves as a case study and warning, outlining the tactics used by these state-sponsored actors and providing recommendations for improving hiring and security processes to prevent similar infiltration attempts.
Image
