Work from home, malware included. [OMITB]

Summary

Podcast Summary: Hacking Humans - "Work from Home, Malware Included"

Release Date: August 5, 2025

Host/Author: N2K Networks
Description: Deception, influence, and social engineering in the world of cybercrime.

---

Introduction to North Korean Cyber Threats

In this episode of "Hacking Humans," the hosts delve deep into the evolving landscape of North Korean cyber threats. Transitioning from a lighthearted introduction about missing dip (a humorous segment omitted here), the discussion pivots to serious cybersecurity issues, particularly focusing on the DPRK's (Democratic People’s Republic of Korea) sophisticated cyber operations.

Evolution of North Korean Cyber Operations

Dave Bittner initiates the conversation by outlining the shift in North Korea's cyber strategies over the years:

"North Korea has transitioned from primarily destructive attacks to more financially motivated operations, aiming to circumvent international sanctions and fund the regime." [05:14]

Keith Milarsky echoes this sentiment, highlighting the tactical evolution:

"They've moved from offensive attacks like the Sony hack to sophisticated money-stealing operations, including cryptocurrency theft and strategic recruitment." [05:55]

North Korea's Use of Cryptocurrency

A significant portion of the discussion centers on North Korea's adeptness at exploiting cryptocurrencies. Dave Bittner emphasizes the technical prowess of North Korean actors in this domain:

"They have become so proficient at stealing cryptocurrency, accumulating hundreds of millions of dollars, creating a vast and intricate financial network." [09:00]

Selena Larson adds context by explaining the historical backdrop of digital currencies used by cybercriminals:

"Before cryptocurrencies, platforms like E-Gold and Liberty Reserve were prevalent among criminals. However, the advent of blockchain technology made crypto transactions more elusive and harder to trace." [14:08]

The hosts discuss the dual-edged nature of cryptocurrency, acknowledging its legitimate uses while highlighting its exploitation by malicious actors:

"Crypto was meant to democratize finance, but it's now being manipulated by cybercriminals for laundering money and funding illicit activities." [15:31]

Recruitment Tactics & Infiltration of US Companies

One of the most alarming topics covered is the infiltration of legitimate companies by North Korean IT workers. Dave Bittner outlines the modus operandi:

"North Korean actors apply for tech jobs, often succeeding in the recruitment process by leveraging fake identities and sophisticated social engineering tactics." [17:53]

Keith Milarsky shares insights from law enforcement experiences, underscoring the seamless integration of these actors into organizations:

"In one instance, for every 50 job applications, about 35 were North Korean IT workers. They even employ AI tools to generate convincing responses during interviews." [21:03]

Real-life Cases and Reports

The episode references specific cases that illustrate the severity of this threat:

1. Arizona Fraud Case: An American woman facilitated the operations of North Korean IT workers from her home, managing multiple laptops to carry out fraudulent activities.

   "She conspired with overseas IT workers to steal identities and apply for remote IT jobs using the victims' information." [23:38]

2. Kraken's Experience: The crypto finance firm Kraken shared how North Korean actors attempted to infiltrate their organization by mimicking legitimate job-seeking behaviors.

   "They crafted fake LinkedIn profiles and even cloned GitHub repositories to distribute malicious code, all under the guise of recruitment." [10:42]

Implications and Future Risks

The hosts discuss the broader implications of North Korea's cyber tactics and the potential for other nations to adopt similar strategies:

"Given North Korea's success, it's only a matter of time before other nations like China, Russia, or Iran adopt these recruitment and infiltration techniques." [24:30]

Dave Bittner warns of the vulnerabilities, especially for small to medium-sized businesses:

"Even companies with rigorous hiring processes are falling victim. Imagine how unprepared smaller businesses might be against such sophisticated infiltration methods." [24:30]

Keith Milarsky humorously suggests unconventional interview questions to identify North Korean applicants:

"Ask questions like, 'How fat is Kim Jong Un?' If they respond, it's a red flag, as they might hang up to avoid offending their regime." [22:37]

Conclusion

The episode concludes by emphasizing the importance of vigilance and advanced security measures to counteract these sophisticated cyber threats. The integration of human psychology, social engineering, and advanced technology makes North Korean cyber operations a formidable challenge for global cybersecurity.

---

Notable Quotes:

• Dave Bittner [05:14]: "North Korea has transitioned from primarily destructive attacks to more financially motivated operations, aiming to circumvent international sanctions and fund the regime."

• Keith Milarsky [05:55]: "They've moved from offensive attacks like the Sony hack to sophisticated money-stealing operations, including cryptocurrency theft and strategic recruitment."

• Selena Larson [14:08]: "Before cryptocurrencies, platforms like E-Gold and Liberty Reserve were prevalent among criminals. However, the advent of blockchain technology made crypto transactions more elusive and harder to trace."

• Dave Bittner [17:53]: "North Korean actors apply for tech jobs, often succeeding in the recruitment process by leveraging fake identities and sophisticated social engineering tactics."

• Keith Milarsky [21:03]: "In one instance, for every 50 job applications, about 35 were North Korean IT workers. They even employ AI tools to generate convincing responses during interviews."

---

Final Thoughts:

This episode of "Hacking Humans" provides a comprehensive overview of North Korea's evolving cyber strategies, emphasizing the intricate blend of financial motives and sophisticated infiltration techniques. By highlighting real-world cases and expert insights, the hosts shed light on the pressing need for enhanced cybersecurity measures to combat such pervasive threats.

Transcript

[Dave Bittner]

You're listening to the Cyberwire Network, powered by N2K.

[Selena Larson]

Guys, emergency.

[Keith Milarsky]

The double jalapeno queso dip is missing from the fridge.

[Dave Bittner]

Okay, Dave, breathe. It's just a dip.

[Unknown]

Did you check if you ate it all last night?

[Selena Larson]

No way. This is a crime. A dip napping. And I'm going full detective on this.

[Dave Bittner]

Here we go.

[Selena Larson]

Step one, secure the crime scene.

[Unknown]

Dude, it's just the fridge.

[Selena Larson]

Step two, collect evidence. Look, salsa drips, Crumbs. A suspicious smear on the fridge handle. The perp was sloppy.

[Dave Bittner]

Or just really hungry.

[Keith Milarsky]

Step three, interrogate the suspects.

[Unknown]

You mean us?

[Selena Larson]

Exactly.

[Keith Milarsky]

Selena, where were you last night between.

[Selena Larson]

These standard dip hours?

[Dave Bittner]

Podcasting. And as much as I love double jalapeno, I was avoiding the dip drama.

[Unknown]

I was on a snack break. Totally innocent.

[Keith Milarsky]

Keith, you're sweating suspiciously.

[Unknown]

Well, it's. It's a bit hot in here.

[Dave Bittner]

You're both ridiculous.

[Keith Milarsky]

Aha. Well, there is fridge camera footage.

[Unknown]

Wait, what? You installed a camera inside the fridge?

[Selena Larson]

Absolutely.

[Keith Milarsky]

Snack security is serious business.

[Unknown]

Enabling fridge footage from June 30, 2025.

[Keith Milarsky]

Look at this. Well, well, well. It's our podcast producer sneaking in and grabbing a dip.

[Unknown]

Recording in progress. Drop the dips. I repeat, drop the dips. Ow. Please stop. I retire in three days. Ow. Have you no mercy? Ow.

[Dave Bittner]

Ow. Ow. Ow.

[Keith Milarsky]

Ow.

[Unknown]

Wait, you can't get rid of me that easily. Ow. Ow. You're getting rid of me easily.

[Dave Bittner]

Wait, what?

[Unknown]

The producer. She's the real culprit.

[Selena Larson]

Case closed. The dip thief has been caught on camera.

[Dave Bittner]

So you went full detective, made us do a mini interrogation, and the dip was stolen by one person none of us expected.

[Selena Larson]

Exactly. Never underestimate the power of diploma.

[Unknown]

I'm just glad it wasn't one of us, Dave.

[Dave Bittner]

Next time, maybe just label your dip. Dave's dip. Do not eat.

[Keith Milarsky]

Where's the fun in that?

[Selena Larson]

And now a word from our sponsor. ThreatLocker, the powerful zero trust enterprise solution that stops ransomware in its tracks. ThreatLocker Protect is the core Threat Locker product focused on endpoint security, designed to prevent unauthorized software from running, control how applications interact and manage access to storage devices. Its building blocks are allowlisting, Ring Fencing, and network Control. Allow Listing is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy, ensuring apps can only access the system resources they truly need to function. Network Control locks down access by port, source, IP, or dynamically with ACLs that automatically update as IP addresses change. Shut out cybercriminals with world class Endpoint protection from Threat Locker. And we thank threatlocker for sponsoring only malware in the building.

[Dave Bittner]

We're pivoting from dips to dprk. Today we're going to talk about North Korean threats and threat actors and how they are both targeting technology workers as well as becoming IT workers within organizations in the US and globally. It's really interesting to take a look at how the North Korean threat activity has changed over the years. Maybe, Keith, you can have us go on a walk down malware memory lane by reminding us of North Korean actors and what are they doing now?

[Keith Milarsky]

Oh, talk about Keith's favorite things.

[Unknown]

I love talking about history. So obviously when we think of North Korea from the beginning, we think of the Sony attack, we think of these destructive type of attacks, we think of hitting the bank of Bangladesh, the billion dollar heist that's out there. So we think of North Korea doing those types of attacks. We love the name Lazarus. We like to play the Toys R Us, like Lazarus games with them. But that's kind of traditionally how we have thought about North Korea with destructive attacks. And what we've really seen them now start to pivot now is, hey, it's going to move just from these offensive type things to like, hey, we're going to steal money to help get past the sanctions that are in place and help fund the regime. So they've really gone from this simplistic types of attacks destructive to now really impressive things where they're not only using malware, they're setting up recruitments, they're trying to get hired. You know, they're stealing cryptocurrency and it's just one big, you know, operation here now. So, you know, that will just dive in here in this episode, which I think is very fascinating going back even further than that.

[Keith Milarsky]

I mean, can we lay out for our listeners kind of what the situation is with North Korea as an actor on the global stage? I mean, they kind of stand alone. Is that a fair way to describe them?

[Unknown]

Yeah, I mean, I think they're different than the other threat actors out there because really their economic espionage, like their espionage operations are so intertwined with criminal activities to steal money right now. So they are a different beast from any of the other state sponsored hackers that are out there. Foreign.

[Dave Bittner]

Obviously are the originals of apt cribbing on crime. So, you know, they for a long time have. Have used their actor, sorry, have used their activity for financial enrichment, for the Hermit kingdom, to build the nuclear weapons, to fund, you know, government operations in a way that you don't really see with other sort of major state threat actors and they've been doing that for a few years now. And, and also what I think is pretty interesting is so they're kind of like this like overlapping threat actor. Right. So they're, they're, they're actually set like their country is directing them to steal money. Whereas oftentimes what you'll see with some of the other apt E crime sort of overlap, it's oh, well, you know, maybe I'm a Chinese cyber, cyber criminal on the side. While I'm, you know, doing work to support the government interests that I'm being tasked with. Maybe, you know, I'm moonlighting as something el. We've seen it with Iran a little bit also, but, but not quite on the same level of North Korean threat actors. And they have, have, I would say they have really become great at stealing cryptocurrency. They are so good at it. It's crazy. And, and hundreds of millions of dollars worth. Right. Like, it's, it's a, it's a big, a big system that they've got going on. And one thing I actually thought was kind of interesting as well is it's not just sort of in that we're seeing some sort of like expansion of their activities or potentially collaborating or working with other groups, but they've also become involved in supporting Russia and their invasion of Ukraine. So we see North Koreans physically on the front and fighting in support of that. And we've also actually seen in email threat data North Korean aligned threat actors targeting government entities in Ukraine likely collect intelligence on the trajectory of Russia's invasion. They're doing kind of a lot. And I think, you know, the stuff that is pretty interesting obviously is like the crypto to enrich the country, but also some of the clever social engineering and some of the tactics that they're using in some of their cyber attacks that are very unique to this particular group of threat actors.

[Unknown]

Yeah. And especially talking about the stealing of the cryptocurrency, you know, what we're seeing out there right now is they are setting up LinkedIn profiles to be recruiters to try to recruit people at cryptocurrency companies or people that are doing work for cryptocurrency companies. Do that. And Selena, do you want to kind of talk about how they're targeting GitHub repositories as well?

[Dave Bittner]

Yeah. So we've seen for example, some sort of like supply chain type of attacks, so compromise NPM packages. You've seen them sort of you know, like upload malicious code on GitHub. There's a really interesting write up about how they are actually trying to clone a repository, have this malicious stuff embedded in the GitHub repository and then they'll direct people to download this. And in these interviews, like, oh yeah, we're recruiting you, we want you to do this. And then here, click to download to use this tool. So it's kind of interesting to see how they're going after the tools and the sort of resources that some technical people would be using, the folks that they're targeting. And so there's been a lot of reporting on how they are actually going after like tech industry specifically. So these job seekers that work in this industry, I think how was it? Contagious Interview is one of the clusters and then going back way far, Operation Dream Job. So you have these like these, these campaigns and ongoing, you know, campaigns that they're called with these sort of code names that are all about job in recruiting and focusing on technology and defense.

[Unknown]

Yeah, I think there was like an operation in 99 was like one of those campaigns I think where they were going after clone GitHub repositories and Mars Tech Mayhem was another name that was out there, you know, that involved JavaScript and Python implants that were served through interview themed lores and fake recruiter Personas.

[Dave Bittner]

Dave, your favorite crazy names.

[Keith Milarsky]

Well, yeah, I want to dig into these job recruiting and the fake employees and all that kind of stuff. But before we get to that, just at a higher level, Keith, we keep mentioning cryptocurrency, right. And I'm curious, you know, from your experience in law enforcement, I mean, you were around when cryptocurrency became a thing, right? What was that like for people in law enforcement to suddenly have kind of this end around of the global monetary system? I mean, is that a fair way to frame it?

[Unknown]

Well, I think it's kind of started before cryptocurrency. So because you had, let's go back to E Gold. If you remember that back in the early 2000s, which was really kind of, it was a platform that was based on the gold currency. I mean, you know, the gold standard and like how much the price of gold was. So you could buy E gold and it was all virtual currency and the criminals used that. And then Eagle was taken down and then it went to Liberty Reserve, which was very similar. And the Russians used web money, which was very big at the time. So. So those digital currencies kind of predated the cryptocurrency but then once you got to crypto, then everything's out on the blockchain there. And it was untraceable and a lot harder to track than those e. Gold or web money and things like that.

[Dave Bittner]

That is so interesting. I have to admit. I did not know about Egold.

[Keith Milarsky]

No, me neither.

[Dave Bittner]

How it was used by cybercriminals.

[Unknown]

Yes. It was one of my favorites to use when I worked. Worked undercover way back in the day.

[Dave Bittner]

So.

[Keith Milarsky]

No, that's interesting. I mean, I, you know, and you hear about it. I mean, even, I mean, look, look, if they're going to figure out ways to launder the money, right? I mean, they're going to figure out where the weak spots are and all this kind of stuff. But it just seems to me like again, we're talking about North Korea, which has, which is so isolated from the rest of the global community, and yet here's a way for them to participate. I'm putting air quotes around participate because you have this borderless, unregulated Wild west currency, right?

[Unknown]

Yeah, yeah. I mean, yeah, you know, it's crazy, you know, the amount of money that, that, that's going through crypto and, and you know, right now, you know, crypto is a big thing here in the States. You know, it's, you know, we have a president, he's the first crypto president, you know, so, so, you know, more and more people are putting their money in crypto and it now this thing of cyber criminals, you know, it's much more legitimate, but yet, you know, the criminals are, you know, exploiting it.

[Dave Bittner]

I did it.

[Keith Milarsky]

Sorry, go ahead, Selena.

[Dave Bittner]

I was gonna say I did a talk at sleuthcon last year, and I did a timeline of ransomware, basically specifically focusing on Russia. And one piece of the timeline was, what was it, 20, 2010 or whatever. Bitcoin invented ruins everything. Huge mistake. Huge mistake.

[Keith Milarsky]

I guess it depends on your point of view, right? Some people would say bitcoin made everything great.

[Dave Bittner]

Oh, my gosh. Yeah, I, I, I can't say that as someone who follows and tracks crypto and mostly used by criminals and how criminals have begun scamming people using crypto, like pig butchering is a huge, huge, huge, huge threat. I, you know, my feelings might be fairly obvious.

[Unknown]

I'll tell you one thing I saw just this week, somebody did an expose on one of the, some of the guys from Conti, and one of the guys is a name true to my heart, this guy Vitaly Kovalev, who's one of the original Godfathers, in my opinion, of cybercrime. But they were talking about that they tracked his crypto wallet, and he has $500 million in that wallet. You know, so here we have a cyber criminal, maybe the first cyber billionaire, here in the upcoming years. It's just, you know, insane when you think about that much money in one crypto wallet.

[Dave Bittner]

I do think.

[Keith Milarsky]

Go ahead.

[Dave Bittner]

I do think it's interesting, though, with crypto, you could track where the payments are going. So you can see, okay, what is DPRK doing with this money? What are they, you know, who are they giving it to? How are they laundering it? Right. What wallets are they going to? And does that wallet have overlapping activity with other potential malicious threat actors? And you're actually able to see this is how much money they're making, and this is where it's going. So I do think from that perspective, it's really, really interesting because it used to be this. Oh, it's totally anonymous, and now it's like. Well, actually, you can see everything that everyone is. Stick around. We'll be right back.

[Keith Milarsky]

Well, in the time we've got left, I want to talk about one specific element to this, which is these stories we've heard about folks from North Korea in particular, applying for US Tech jobs and getting the jobs. So let's unpack that a little bit, how that's possible and what the implications are for us and for them. Selena, will you want to start things off for us?

[Dave Bittner]

Sure. So it's this massive problem of IT Workers from North Korea working at legitimate companies. And so they will apply to these jobs, and they will, you know, go through the entire recruitment process, and they will actually obtain these jobs, mostly, you know, tech. Tech jobs. And what's also very interesting is they have a network of supporters, not just, you know, they're not just operating exclusively with North Korean threat actors. Right. So there was a very interesting story from. For example, I'm from Arizona, so this was particularly interesting, but there was this Arizona woman who, you know, was working and basically facilitating these DPRK workers from her living room. And so she had all of these laptops, and she was doing a lot of the work that they were asking her to do, and basically forwarding the work from wherever the North Korean actor was, you know, China or Russia or wherever that they were physically located to having access. Oh, I'm in Arizona. Like, this is my. This is my job. And so essentially, what they're doing is they are infiltrating these companies, and they're making a lot of money. And in many cases they have multiple jobs that are making lots of money and detects actually put out a pretty interesting report on some of these threat actors. They published a thousand email addresses that were used by these actors. They named some in particular dropped their images, explained, you know, this is, this is how they've been working and how this actually works. But it's a big and insidious problem. And I think it's really interesting when companies actually publish like, hey, this happened to us. And so Kraken, which is a crypto finance firm, which I have to say a lot of these guys, they want to go work at these crypto firms. It's an interesting tech job. And so with Kraken published a really interesting blog and went through the process of they applied for this job. Here's how they tried to get in, here's how we caught them, and here are some of the ways in which the questions that we asked and the things that we made them do to try and identify that actually they were fraudulent. And so they have these red flags and all of these things, but they do that. And honestly there's a lot of reporting that they're using AI enabled tools. So they have something set up where they get asked a question and then they put the question through whatever LLM it is that they're using to provide an answer. And so this is sort of this like real time. And you know, we talk about some of the challenges or risks of AI and LLMs and this is a great example of them using it to enable their fraud, basically.

[Unknown]

I got a great story with that too. So I was talking with my, with a CISO friend of mine and he said they were probably about, for every 50 applications, about 35 of them were these IT workers. And he said, you know, that they were deploying different techniques in the interview, you know, because like somebody was supposed to be from Tampa and one of the guys that was interviewing the person was from Tampa. So he's like, well, how's the weather out there? And they couldn't answer it. And they could see him looking up to somebody to look on Google, what's the weather in Tampa? And it was just different things like that they would make the person get up and move. So if there was an AI generated face there, if the person would move, you could see it. So they were kind of having fun with that. It's kind of that first line of seeing if they could detect it. But it's very prevalent from, you know.

[Keith Milarsky]

What he told me at the RSA conference a couple weeks ago, Adam Myers from CrowdStrike was doing a session and said that an interview question you should add is how fat is Kim Jong Un? Because if you ask that question, they will hang up. That is great, allegedly, because it's not worth them answering the question and getting in trouble with, you know, dear Leader. So they will typically end the call. Yeah, isn't that funny?

[Dave Bittner]

I, I also think it's pretty interesting that this is something that's going on for quite some time. It's really come to the general public recently and I think just because it's so bad now, that it's been very, very effective. But for example, in the case of the Arizona woman who is, I believe, yeah, she just pled guilty to this fraud scheme. It said that she was this American citizen conspired with overseas IT workers from October 2020 through October 2023 to steal the identities of US nationals and use those identities to apply for remote IT jobs. So, you know, this is something that has been going on for some time and she obviously had a business running a business. Speaking of startups in business enabling, you know, IT worker fraud. But, but it is something I think that has been going on for so long, was pretty successful because now we're at this tipping point where it's like, oh, this is actually bad. And you have, you know, companies talking about we hire accidentally hired an IT worker, here's what we did. And, and just, you know, all coming out with these, with these stories, which is such an interesting human interest story in my opinion. Like, it's such a weird human story.

[Keith Milarsky]

The stories that are coming out describing this are from cybersecurity companies who've had it happen to them. So these are not unsophisticated people. These are people who have lots of steps in their hiring process and lots of vetting. So I have to imagine that if folks with that level of sophistication are falling victim to this, imagine your small or medium sized business, your mom and pop shop who's just looking to hire a fractional CISO or just somebody to help remotely. They're sitting ducks when it comes to this, potentially.

[Unknown]

Yes, absolutely. And just the other thing is the sheer number that North Korea of people that are thrown at this. But now, you know, there's always going to be copycats, you know, when you see the success of that. So now, you know, are the Chinese going to start doing this? You know, are the Russians or the Iranians? Because, you know, why spend a lot of time trying to get in with Malware and try to get through those defenses. You know, that does, you know, when you can just kind of go right through hr, you know, and get somebody in and actually get a computer from the company and, you know, so, you know, when are the copycats. When are we going to start seeing that? You know, in my opinion, we're going to see pretty quickly.

[Dave Bittner]

Well, and this is actually interesting because we, you know, we. In a previous podcast, we're talking about some of the overlap between APT&E crime. This is one thing that I think will definitely stay in the realm of espionage, like cyber. Cyber criminal threat actors are not going to bother going through this whole process of actually getting jobs. In fact, you know, a lot of them probably are not at the level of being able to apply for a technical job at stealing someone's identity and applying for a tech job, but at that point, they should just. Just not be doing crime.

[Unknown]

Yeah, right.

[Dave Bittner]

Yeah.

[Keith Milarsky]

If you're that skilled. I mean, come on.

[Dave Bittner]

Yep. There's more to come after the break.

[Keith Milarsky]

Well, it's an interesting thing and obviously something to keep. Keep an eye on, but it's a fascinating kind of subset, or subculture even, of online crime that people just have to be vigilant against. Thank you both. This is an interesting conversation and we will see you both back here next time. I'm going to go and try to recover what's left of my dips.

[Dave Bittner]

Can you share your jalapeno dip next time, Dave?

[Keith Milarsky]

No, I cannot.

[Dave Bittner]

And that's only malware in the building. Brought to you by N2K CyberWire. In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. As your trusty digital sleuths, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you ahead of the ever evolving world of cybersecurity. If you like the show, please share a rating and review in your favorite podcast app. This episode was produced by Liz Stokes. Mixing and sound design by Trey Hester, with original music by Elliot Peltzman. Our executive producer is Jennifer Ivan. Peter Kilby is our publisher.

[Keith Milarsky]

I'm Dave Bittner.

[Unknown]

Hello, I'm Keith Milarsky.

[Dave Bittner]

And I'm Selena Larson. Thanks for listening.

[Keith Milarsky]

Thank you.

[Selena Larson]

To ThreatLocker, the powerful Zero Trust Enterprise solution that stops ransomware in its tracks. For sponsoring only malware in the building, visit threatlocker.com.