Wild, true story from the security awareness and training company KnowBe4 that details how they inadvertently hired a North Korean hacker who was posing as a Western tech worker.
Kudos to them for publishing this. If it can happen to a security awareness company, it can happen to anyone (full disclosure: they've been an advertiser on my site for ages).
https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us
@not2b @briankrebs It’s not that he messed up tbh, it’s that they actually proper monitors/logs on employee devices.
The reason dude shamelessly went about installing whatever he wanted and crawling for sensitive dox was bc 99.99% of organizations DON’T detect this type of activity. 😱
They are currently working at thousands of based companies, especially as remote engineers in tech, ai, crypto, etc.
@not2b @briankrebs Oh, 100%. It’s just that they don’t need to. DPRK guys tend to do *exactly* what is necessary to execute their goals.
For example, we saw resumes, GitHubs rapidly evolve when orgs started to notice mismatched geo’s / work history (and GH started whack-a-moling 🙇♀️)
They started interviewing on-cam when orgs began to flag no-cam candidates during initial screens.
No doubt they’ll delay/obfuscate initial activity if orgs start to monitor and detect it, too.
BrianKrebs
Joe ❌👑
Tay