Wild, true story from the security awareness and training company KnowBe4 that details how they inadvertently hired a North Korean hacker who was posing as a Western tech worker.
Kudos to them for publishing this. If it can happen to a security awareness company, it can happen to anyone (full disclosure: they've been an advertiser on my site for ages).
https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us
@WarySec @briankrebs Yes, though likely not the *exact* laptop farm. But that story is the best public detailing of how these laptop farms work. It’s extraordinary, def recommend full indictment PDF
@WarySec @briankrebs also have a highlights thread of said PDF on Twitter (sorry to make y’all choose between long legal pdf and twitter 😅)
@tay @WarySec @briankrebs no need to choose, can just get this version without visiting Twitter itself
https://xcancel.com/tayvano_/status/1791244750173167706?mx=2
@not2b @briankrebs It’s not that he messed up tbh, it’s that they actually proper monitors/logs on employee devices.
The reason dude shamelessly went about installing whatever he wanted and crawling for sensitive dox was bc 99.99% of organizations DON’T detect this type of activity. 😱
They are currently working at thousands of based companies, especially as remote engineers in tech, ai, crypto, etc.
@not2b @briankrebs Oh, 100%. It’s just that they don’t need to. DPRK guys tend to do *exactly* what is necessary to execute their goals.
For example, we saw resumes, GitHubs rapidly evolve when orgs started to notice mismatched geo’s / work history (and GH started whack-a-moling 🙇♀️)
They started interviewing on-cam when orgs began to flag no-cam candidates during initial screens.
No doubt they’ll delay/obfuscate initial activity if orgs start to monitor and detect it, too.
@feld @pete_wright That's interesting. A lot of times, the only way you'll know something is off is by talking to them, ideally over video so you can match a name with a face and see how they react to different things. I remember a while back reporting on the hack of the FBI's Infragard portal, the feds vetted and approved a fake application in the name of a CEO of a credit rating agency. But they never called the number in the application, even though the fraudster had submitted the CEO's real mobile number in his application!
https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/
@briankrebs @feld @pete_wright
but here they say
> Our HR team conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application.
So the photo was modified to match the real person? And that person was actually doing the coding? Or are they using some high quality deepfake for every video call? Because that means more video calls would still not solve it...
@briankrebs seriously, though...
the haircut didn't raise any flags?
My work uses this company, this is exactly like one of their learning exercises. Hope they change it up now, it's pretty boring
@gabe @briankrebs maybe the PI was running pi-kvm or a VPN gateway. Otherwise I don't get either why a PI would be involved in downloading the file and how they would know that a PI even was involved.
Also was he circumventing sanctions or doing something malicious?
Jeroen Gui 
BrianKrebs
Jeff
EricFate
Tay
Jérôme
Hugo
Joe ❌👑
Pete Wright
feld
chebra
dr2chase
MrAptronym
CodeByJeff
FULL-FIFO DEVELOPER 🇺🇦🇨🇿
Abby Crofton
Aditya Sarangapani
Petrol
Alexander Sosedkin 
rholland_again-again
Gabe
truh
Ansis Māliņš
ṫẎℭỚ◎ᾔ ṫ◎ℳ