- Nisos reveals network of fake identities, all looking for software development work
- At least two people work in small businesses
- The goal is to make money for Nordkorea’s weapon program
North Korean cyber criminals fall their identity to get jobs in software development companies in Asia and the West, new research has claimed.
A report by researchers Nisos claims to have identified at least four fake people working as software developers, blockchain developers, IT benefits and the like with the goal “to make money to finance Pyongyang’s ballistic missile and nuclear development programs.”
To create these fake identities, the threat actors use GitHub and recycle mature Github accounts and portfolio content from older personas. This helps them backstop their new identities, the researchers said. It also helped two people to get jobs from companies with fewer than 50 employees.
Lazarus?
While these identities have accounts about employment and people’s information sites, they do not have social media accounts, which is always a red flag. Furthermore, their profile photos are “photoshopped” and in some cases they have obviously inserted another face over a stock photo to show those working in a team.
Finally, all persons in the network use similar E -mail addresses, often including the same numbers and the word “dev”.
Although it is difficult to know for sure, Nisos says there are “more indicators” that the hackers are affiliated with the North Korean government, including “consistent tactics, techniques and procedures (TTPs) attributed to the North Korean employment fraud.”
Previously, there have been reports of Lazarus, a well -known North Korean state -sponsored threat actor hunting for software development jobs. Being hired helps them access the company’s back end, which they use to steal sensitive data or even money.
Lazarus was also observed and created fake companies and fake jobs, and software developers in the main hunt in major IT companies. During the “employment process”, they would drop malware on their victim’s devices with the same goal of accessing their employers’ IT infrastructure.
The group is usually targeted at blockchain-related companies and has drawn some of the biggest crypto-heists in history.
