North Korean Remote Workers Expand Operations Beyond IT into Sales and Marketing
Suspected North Korean remote workers are increasingly infiltrating legitimate companies by posing as sales, marketing, and even medical professionals, presenting a novel challenge for cybersecurity defenses.
Suspected North Korean (DPRK) remote workers are broadening their recruitment efforts beyond traditional IT roles, now targeting positions in sales, marketing, and the medical field, according to a recent analysis by Huntress. This shift represents a significant evolution in their operational tactics, moving from purely technical intrusions to a more insidious form of infiltration.
These actors pose a unique detection challenge for defenders. Instead of exploiting vulnerabilities or compromising accounts, they actively trick organizations into hiring them for legitimate roles. Once onboarded, they often perform the actual work they were hired for, making them exceptionally difficult to identify as malicious actors. This approach leverages deception and social engineering to gain a foothold within target organizations, bypassing many traditional security perimeters.
To mask their true identities and locations, DPRK workers frequently employ stolen identity documents, Virtual Private Networks (VPNs), and proxy services. This necessitates the use of advanced verification methods beyond standard background checks to confirm an employee's identity. The sophistication of their deception is highlighted by the methods used to create fraudulent documentation.
In one case involving the Australian healthcare sector, Huntress observed login records showing repeated connections through Astrill VPN and IPRoyal Proxy. A significant portion of their activity occurred outside normal business hours, aligning with North Korean time zones. When attempting to verify their identities, three individuals submitted what appeared to be legitimate documents, including resident ID cards, passports, and electricity bills.
However, a closer examination revealed alarming inconsistencies. Passports were issued in the same city on consecutive days, ID cards shared identical validity dates and issuing police stations, and the photos, while unique, were taken minutes apart using the same phone model and at similar angles. Even the rear of the resident identity cards showed consistent damage, suggesting a shared fraudulent template. Electricity bills contained identical typos and appeared to be based on an online template, possibly due to translation errors from optical character recognition (OCR) processes.
Beyond document forgery, sophisticated hardware is also being employed. In a financial services firm, a PiKVM device, a Raspberry Pi-based KVM-over-IP tool, was connected to a new hire's laptop shortly after delivery. This device allows for remote operation of the computer. Windows logs indicated the laptop transitioned from a managed network to a travel router, then to a home Wi-Fi network, and finally to a wired connection, suggesting it was integrated into a 'laptop farm.' A Guermok USB capture card was also attached, capable of routing video streams as webcam input for conferencing applications.
Further complicating detection, a sales and marketing hire at another organization allegedly used another person's identity with a swapped photo. While identification numbers passed validation, a comparison with a police mugshot revealed a mismatch, indicating digital alteration of legitimate identity information. The individual's refusal to appear on camera when requested by the company further raised suspicions.
The threat posed by DPRK remote workers is persistent due to the inherent difficulties in detection. Mitigating this risk requires a multi-layered approach, starting with rigorous vetting during the interview process, thorough background checks, and online verification of new hires. Vigilance throughout the onboarding and employment lifecycle is crucial to identify and neutralize these deceptive infiltration tactics.