- North Korean hackers have imitated job applicants
- These applicants get employment in Western companies
- New research suggests these campaigns have been going on since 2016
North Korean hackers have recently made the headlines by fraudulent to get employment in Western companies. Research from Sophos’ Counter Threat Unit (CTU) has tracked this as the Nickel-Tapestry campaign, identifying infrastructure connections suggesting that money revenue schemes have been in operation since 2016.
Research shows that the campaign is increasingly aimed at European and Japanese organizations – probably thanks to increased awareness of US companies. These fraudulent job applicants have been observed that mimic Japanese, Vietnamese and Singporic professionals as well as American persons.
Previous research has shown that North Korean hackers constitute themselves as software development recruiters to target freelancers, spread malware through recruiting fraud and stealing cryptocurrency from the victims.
Double target
The wages earned by the hackers seem to help fund the government’s interests for the Democratic People’s Republic of Korea – and record breaking of crypto fraud has also successfully earned Lazarus Hacking Group $ 1.5 billion. About $ 300 million of this was successfully transformed by the group into irreparable means of this one event alone, so these campaigns are lucrative for the state.
However, that is not all, as the false workers have also been observed to steal credentials and exfiltrating data as well as deliberately gain employment in industries with sensitive data, such as defense, space and cyber security.
These roles allow workers to use remote access software and AI -generated writing, CV building, image editing and video improvement tools to emulate legitimate workers and bypass standard systems.
Organizations are encouraged to remain vigilant and check candidate identities thoroughly and review their CVs and addresses thoroughly, even hinted at personal interviews where possible.
As remote positions become more and more popular, companies “monitor for traditional insider threat activity, suspicious use of legitimate tools and impossible travel alarms to detect activity often associated with false workers,” confirms Sophos.
