← Threat Vector by Palo Alto Networks
Threat Vector by Palo Alto Networks
Encore: The Billion Dollar Hiring Scam Funding North Korea
00:38:27
Loading summary
Transcript45 lines
- [00:02]
A
You're listening to the Cyberwire Network, powered by N2K.
- [00:12]
B
Welcome to Threat Vector, the Palo Alto Networks podcast, where we discuss pressing cybersecurity threats and resilience and uncover insights into the latest trends. I'm your host, David Moulton, Senior Director of Thought Leadership for Unit 42.
- [00:25]
A
Talk to your HR team. If you aren't yet and you are a network defender and you don't have that bridge to the HR team, please build it. That's the number one place where we're finding success in detection. That's the number one place where we're finding success in collaboration is HR team says, hey, something is fishy here. We need the security team to interact with it. Or the security team is able to back up the HR team programmatically to say, hey, I think you interviewed a North Korean, or hey, I think you're about to interview a North Korean.
- [01:12]
B
Today I'm speaking with Evan Gordiker, consulting Director focused on AI and disrupting the activity of the dprk. Evan has led extensive investigations into state sponsored cyber operations specializing in the disruption of North Korean IT worker networks. Today we're going to talk about navigating the evolving DPRK IT worker threat, why this campaign matters, how IT operates, and what organizations can do to detect and defend against it. This topic is critical because these covert IT operations have become a billion dollar funding mechanism for North Korea's cyber and weapons programs exploiting global remote work and weak vetting controls. Evan, welcome to threatvector. Really excited to have you here today and that we actually get to talk about this specific topic.
- [02:07]
A
Thanks, David. Thanks for having me. Great to be here.
- [02:10]
B
I know that you've been investigating this issue for years. I want to say a few years back I ended up having a conversation about this problem with one of your colleagues on Threat Vector, and we mothballed that episode, but we're now able to talk about it. I'm curious when the North Korean IT worker threat first appeared on your radar.
- [02:35]
A
Yeah, on my radar. 2021. But it's been going on much longer than that. I grew up in Japan and when I was going to school is when they were testing their rockets. So sometimes they would fire their rockets over Japan and we would have drills at school about that. So I've been fascinated with North Kore ever since. And I've been able to interact with this threat fairly directly now for several years. And I think it's a really fascinating threat. It's not going anywhere. Everybody is affected by it. So the more that we talk about it. The more that we can share about it, and the more that countries themselves are able to work with each other about it, the better we can go towards disrupting this and making sure that people's jobs go to actual people that aren't funding North Korean weapons programs.
- [03:22]
B
So before we started the podcast, you and I were talking about how this focus for you with the North Koreans and especially the IT workers was a passion project. Is that time that you spent in Japan something that influences the fact that you decided to assign extra work? You know, in addition to the proactive security consulting that you do with our clients, you also pick this up. It's too important to ignore. What is it that drew to you?
- [03:53]
A
I think it's. It's a very human threat, that there are humans in the cycle that are affected by this, starting with the North Koreans themselves. These are people that realize they're good at technology. They pass a math test when they're in about middle school age. And if they're good, they get trained up on English, they get trained up on computer science. And to me, it's really fascinating that it's like they're being coerced into this work as well. And there have been some defectors that have talked about this, where there's just this chain of victims that follow straight from the top of the North Korean regime, and then just victim, victim, victim, victim. And along the way, there are a few people that profit, but most of all, the people that profit are the leaders of the North Korean regime. I think it's fascinating how they stack up all of these victims, and yet the program is so successful that even though we've been talking about it for years, even though the FBI has been trying to disrupt it for years, it's still just as successful as ever.
- [04:56]
B
So you talked about this as something that's been going on for years. I'm curious if you can give us a snapshot of how this has shifted in scope and sophistication over the years. And has generative AI helped accelerate the program? Has it changed it? Remarkably? You know, just give us a picture of what you're seeing there.
- [05:18]
A
Yeah, the North Koreans have really made this a mechanized operation insofar as there are people who are dedicated to doing interviews, for instance, who are dedicated to finding accomplices on the ground who are dedicated to doing the actual job. And they vary in quality, but what you'll find across the whole spectrum here is that they all are very, very reliant on Generative AI. And it's getting To a point where they're using it in very clever ways. But from the very beginning, they've been very reliant on using it to write their emails, to write their code to. Now they're using it to do deep fakes. Real time video, deepfakes, real time audio, deep fakes. Just the other day there was reports that people are using it to change their accents. The North Korean accent is fairly distinctive. And now they're using it in real time to change their accent. And so I expect this to continue in perpetuity. It's not a vulnerability that is going away, and it's a huge place where money is being made for the regime.
- [06:25]
B
Evan, DPRK IT worker threat has evolved quite a bit since security community first began talking about it. And we need to talk about how the DPRK IT workers are moving past some old assumptions, embracing new tactics to embed themselves within organizations.
- [06:42]
A
So when we think about how the DPRK IT worker threat has evolved, we're seeing a focus towards more use of accomplices. They're using accomplices during the interview stage. They're using accomplices during the application stage. They're using accomplices to even get people into offices. So there's this assumption that I come across a lot where it's like, hey, we don't really hire remote workers, so we're safe. And what we found is that that's not necessarily true. For one, the North Koreans love to get in through the contracting angle. And sometimes business is such that you do need to hire like 10 people to work on a front end app because leadership tells you we want this in two weeks from now. And so often big companies have the muscle to be able to surge in talent. And that's really where they get you, is like you're surging in talent for engineering work. And, you know, maybe seven out of those 10 people could well be North Koreans. We have seen real instances of that exact count. The other thing is they're able to pay people now to go sit in an office and fire up a zoom, give that zoom remote control, and just have somebody work on their laptop on, you know, someone else's behalf. And what the North Koreans are doing is they're hiring people in the United States and around the world to just go into offices and pass verifications. But then once they're there, they're enabling remote access, and that's where the exfiltration happens. That's where some of the wage theft occurs.
- [08:11]
B
So let's go back to the beginning and Talk about this idea. For those that don't know what the North Korean IT workers problem is, can you just give me the, like, the beginner snapshot? I imagine most of our audience knows, but I want to make sure that we're. We're clear on that point.
- [08:31]
A
Yeah. The North Korean IT worker threat is this operation that's been going on for about 10 years now where North Koreans are getting legitimate jobs posing as people that are allowed to have those jobs. They're taking the money from those jobs and they're funneling it directly into the regime. So about 80% is the thought of wages get garnished by the North Korean regime, with 20% left behind for paying facilitators, paying accomplices, and paying the people that actually did the work themselves. So these are people that are sitting. They almost all are male, although some are female. They're sitting in apartment blocks in northeastern China, they're sitting in apartment blocks in eastern Russia. And they're just logging in and doing work. And sometimes it's real work, sometimes it's actually good work. We've had clients tell us, oh, that guy was a really good developer. It's almost a shame that he was North Korean. But most of them are kind of fly under the radar. Performance isn't so great. They're probably juggling three or four of these jobs at a time, and they're able to get into the soft underbelly of corporate America, of white collar work, and they're able to take those wages and funnel it directly into the North Korean regime.
- [09:45]
B
And then if you were to take that a little bit further, you have this job as an IT worker. How is that more effective than just a direct cyber attack going in and putting ransomware, or stealing and demanding payment to get your information back or to keep quiet about an attack?
- [10:07]
A
I think what they've ultimately found is that there's power and volume, and because they're able to get so many of these jobs, they're able to generate millions and millions of dollars. So hundreds of millions is the thought. If you add it onto the larger cyber operations that North Korea does, it's billions per year. And what they're able to do is have thousands of less sophisticated individuals generating currency for the, for the North Korean government this way. And it's also consistent, you have these paychecks across thousands of people. There's a sort of baseline income that can be established this way. So it's not as bursty as some of the, like, large scale crypto theft attacks that they've been attributed to Evan.
- [10:54]
B
Your research estimates that thousands of DPRK IT workers are active globally, generating hundreds of millions in revenue. As you just called out, what does the scale mean for global businesses and governments?
- [11:13]
A
It means you are being targeted. So if you're a global organization, then you probably have North Koreans applying to your jobs. That can almost guarantee it. And what this means is any jobs that you have, certainly if they're remote jobs, you are being targeted. But even lower down the totem pole, they definitely do go after hybrid jobs or in person jobs, especially in the front end engineering, backend engineering, database admins, IT admins. Those are the type of roles that they go after if there's low human contact. As an I don't have to sit on a call that often. I don't have to be responsible for output that often. Those are the jobs that they're going after. And it doesn't really matter where in the world you're hiring. We've caught North Koreans with jobs in Brazil, we've caught North Koreans with jobs in Serbia. It's sort of around the world they're targeting these jobs. And again, it was traditionally thought to be sort of an American problem, but there was a fundamental shift towards Europe in late 2023 and then now expanding around the world to target other parts of Europe, other parts of Asia, and trying to get those jobs really anywhere they can get them. So I would really think about if you are a global organization or if you're an international organization and you have headcount, which is just about any listener, you're going to be targeted by North Koreans. And understanding what you can do about that is probably going to be more productive than saying, oh, we don't hire remote.
- [12:50]
B
And yeah, the head in the sand strategy never ends up working out well. So let's shift gears a little bit and talk about tradecraft and technology. The briefing describes the use of fake identities, of AI generated headshots, and even some really convincing deep faked interviews. How sophisticated have these deception tactics become?
- [13:16]
A
I'd say they are noticeable if you know what to look for by the naked eye still. But there will come a point where that's no longer true. So these fake identities, they'll spin up hundreds of identities. Sometimes we've noticed on individual North Korean computers, for instance, that there are spreadsheets for hundreds of different identities that this person is managing. And they will come with tailor made resumes, headshots that depict them in various positions. So sometimes we'll find like stock photos that are just face Swapped in. So it's a stock photo of someone posing in front of an American flag, for instance. We really have seen this. And they face swap the North Korean operator's face over that. And when they show up to these interviews, sometimes they're just deep faking from the beginning, and sometimes they deep fake celebrities, which I think is very interesting, but they're trying to show up. And what this does is when you're on camera, you can show up as someone that doesn't have the appearance of someone who might be East Asian. And that might be something that HR teams are looking for right now, even if they won't admit it. The other thing is they can avoid being detected. So we have a collection of North Korean operators faces, for instance, and they're probably trying to avoid some of that. The third thing is they can show up multiple times to the same interview. You can imagine, right, David, you're hiring for someone. I throw in 400 of your 1000 resumes that you receive, and then I can show up as one person one day, fail that interview, show up as someone else the next day, and then potentially pass that interview. So I think there's a lot of advantages for them in that anonymous setting.
- [14:57]
B
And let's talk about those detection tools. I mean, obviously you've got folks that think they can spot things or they start to feel like they're trained. But to me, it's the scale of this and the tenacity of this problem means that we're going to need some level of systems, processes, and tools helping us out. Are those tools? Are our verification processes keeping pace with the advancements on the deepfake side or the spreadsheets full of identities?
- [15:29]
A
I would say broadly, no, they haven't been, and they probably never have been, because this is not a threat that the commercial hiring scheme has ever been equipped to handle. But what I will say is, at least today and for the foreseeable future, deepfakes are detectable, probably not by the naked eye for very long, but there are ways that you can get deepfake detection. There are plenty of tools and technologies out there that can help you detect when there's a deep fake in your meeting, for instance. The other thing is that IDs are pretty hard to fake still. So these North Koreans, they will use Chinese black market ID shops to get their IDs, where it's like, Hey, I can hold up my ID. It says I'm in Texas, no problem. But are you actually verifying that those IDs are real ID verification? To me is the number one way that you can detect these things where it's like, hey, we'll give you a job offer, but you have to pass an ID verification. Beyond that, I think being able to look at your hiring pipelines to make sure HR team A understands that this is a threat and then B is doing something about it. So you can see, hey, where are these job applications coming from? What is some of the metadata associated with these resumes? And you can start to understand as these things fly in, how many of them are potentially fraudulent. Not necessarily North Korean, but there's definitely signs that they could be North Korean. On top of that, those are things that you can start to detect programmatically and at machine speed. Now.
- [17:36]
B
Let's talk about the insider risk side of things. And specifically I want to get into this idea of facilitators. You've written pretty extensively about operations that are dependent on a facilitator network. People that receive the hardware that are managing an account and you know, from the profit side, transferring the money. How critical are these insider accomplices to these operations?
- [18:03]
A
Absolutely critical. Couldn't do it without them. So there's a number of different types of facilitators. The one that's most classically associated with this scheme is the laptop farmer, which is somebody who sits in the geography you're targeting. Let's just say the United States in this instance, who will receive the laptops for these companies, boot them up, log in, set them up with remote access. And this remote access can come in the form of software where just software that's commercial that you can use to access the computer. It may come in the form of hardware. These are KVM over ip, so machines that you can just plug into USB port, plug into DisplayPort, and suddenly you have something that behaves just like a human is on that machine. There's also use cases where the North Koreans are using malware to control these machines. So it's not just commercial software anymore either. With the rest of the accomplices, we've seen their dependence really grow. So there are now companies, real companies in South Asia especially, that specialize in showing up to interviews for you, just doing interviews on your behalf. Those are real companies that in some cases have been ceded and made successful by this North Korean scheme. There are others that are going around freelancer sites and just trying to find folks that are willing to mule their identities. So identity mules are people that will just serve as that final verification. Separate, like, hey, I am a real American. I'm allowed to work here, and this is my id. And that way you can beat some of that ID verification piece. And then now there's additionally accomplices who are going out and finding accomplices for them. What they'll do is they'll pay some of their laptop farmers, for instance, to go and introduce them to friends, and pay them quite well in some instances. So now these laptop farmers are motivated to go and find others. Some of them, they recruit their friends, some of them, they go online and they recruit strangers to freelancing sites. And so this web of criminality just kind of expands outwards and they like to spread their risk so that when any given laptop firmer gets arrested, they are able to just pivot to another one. And it's not a big deal where they lose hundreds of machines. It's more like, oh, well, we lost two of our laptops. Those are two jobs gone. Doesn't really matter, we'll just pick it up and start again.
- [20:32]
B
Let's pivot to extortion and espionage. You know, the core mission was initially revenue generation via salary theft, but now we're seeing a pivot where recently fired IT workers threaten to release former employer sensitive data, including proprietary code, unless a ransom is paid. Does the aggressive extortion signal a broader shift from revenue generation to strategic espionage and disruption?
- [21:02]
A
There was always espionage and data theft. Since we started working on this in around 2021, when people really started to get privy to this and come to us with instant response cases, we noticed that they were kind of cookie monsters. They would grab whatever data they could get their hands on and steal that away, sometimes to very obvious means. If it's a aerospace company and they steal data related to how to design aerodynamic aircraft, for instance, then that totally makes sense for the regime. But other times there's nonsensical things were getting stolen, like acceptable use policies for a specific company, or they were stealing front end code that was pasted online. Anyway, they were always motivated by stealing this data. And I think they have a treasure trove of data that could be useful for follow on attacks by the North Korean regiment. But I think beyond that, they've always been trained, hey, just go and grab data. The shift that we're seeing, and this started kind of late 2022, but has really accelerated in 2025 is this extortion piece. So what they do is they say, hey, you fired me, but I actually stole your data, I stole your customer data, I stole your proprietary code, I stole some of your policies. And they come and say, hey, if you don't pay me my last paycheck, or if you don't pay me $4,000, I'm going to leak this online. And they do, they really do leak it online. But this aggressive shift towards saying, hey, the cat's sort of out of the bag, right? People are fairly aware of the North Korean IT worker threat, and so now they're being much more aggressive about going after that final paycheck, going after a follow on payment that might be useful, and in some cases it really works. So I would expect this to continue. It wouldn't surprise me if they got more aggressive with things either.
- [22:54]
B
Evan, let's shift our focus a little bit and talk about detection. What signals should SOC teams and HR departments watch for when reviewing employee or contractor profiles?
- [23:06]
A
Yeah, so I would start this as primarily detection of HR data. And many security teams still aren't in great contact with their HR departments. So if you're able to please introduce this threat to HR departments, sometimes they are surprised when they hear about this and then get to a point where the SOC is able to access HR data. Not necessarily just data about who people are, but also data about how did these applications come in, how did the interviews go? Was there any indication during the interviews that something might be amiss? We've noticed that when HR teams are properly aware of these, they actually detect things on their own. So many of our clients tell us, hey, now the HR teams reach out and tell us, hey, I think this person was a North Korean. And the SOC will go and investigate some of the artifacts that might be left behind. And they'll say, yep, that person you interviewed was definitely North Korean. Let's make sure we don't hire them and move on. So all the primary defenses will come before the person is hired. So you want to be looking for things like what sort of infrastructure was used to attend the interview, how did they interact with the interviewer, did they say anything specific about where they claim to live, for instance? Sometimes that can be a fairly good indicator. Once you think about can we detect these things once they have been hired, it's going to be a lot of hunting for remote access tooling. And hunting for these tooling, I think, is going to pay dividends for you regardless of the threat. The ransomware actors love these RMM tools, for instance. So making sure that you are locking down the environment so that remote access is very, very difficult will go a long way to preventing this threat.
- [24:54]
B
So I know you've led some of the incident response for companies that have unknowingly hired some of these fake IT workers. What were some of the common mistakes organizations made once they discovered that there was a threat?
- [25:10]
A
I think there tends to be a little bit of a period of shock. This was more common back a few years ago, before this threat was widely known. But the shock of, like, this person wouldn't be North Korean, like, how do we know this person is North Korean? And I think in the moment, it doesn't really matter when they're North Korean or not. What matters is that you had a malicious insider and you should go and lock down your environment to understand where did they have access? Have we cut off their access effectively? And what did they take with them that's probably more important than establishing their identity right off the bat. Once you get some of those kind of immediate hair on fire moments out of the way, then you can really sit down and have that conversation, especially with your legal team and external counsel, to understand if this person was North Korean, what sort of risk does that introduce? So you'll probably want to be able to answer questions like what did we do for identity verification, if anything, and what do we do for background checks? And were there any inconsistencies there? And once you go back and look at the full scope of the, of the investigation, you'll probably be able to tell where there's opportunities for improvement in your processes. But I wouldn't get bogged down, especially in those first few hours or days, about whether this person was North Korean or not. I would get bogged down with understanding what did they do and what did they take? Because that's probably more important in the moment than figuring out the motive.
- [26:35]
B
I imagine you didn't think you were going to get out of this interview without talking about AI and as AI has accelerated things like email perfection, maybe helping with accents, working on, you know, the deep fake side of things. How is generative AI rapidly reshaping this problem?
- [27:00]
A
What we're finding is that it's not just North Korea, that A, there are other nation states that may have picked up on this as a vector and are starting to experiment with it. But there's also just fraudsters who are experimenting with this. And what AI is doing is it's enabling anyone to sound like an expert. And your HR team has surely noticed this too, where the amount of applications that we're getting now that looked picture perfect and polished is crazy. And HR teams are unable to keep up with this volume. And part of that is because A, the North Koreans have absolutely mechanized this. They have Automated applications. They have teams of people who are just using ChatGPT, et cetera, to get picture perfect resumes and just firing them out there, hundreds an hour. And you have all these other people, these fraud actors that are interested in getting into your company and stealing money from you. The role of AI is number one about proliferation. It's not just North Koreans, and when it is North Koreans, it's a lot more of them. The other thing is that this is making it more effective that you're able to mask identities really effectively using AI, that you're able to change your appearance or what you sound like. So I'd expect this trend to continue kind of in perpetuity.
- [28:17]
B
Let's flip the script a little bit. Are there AI driven defense strategies that are keeping pace with, you know, you mentioned the synthetic identities or any of the types of problems that HR teams are having or IT and security teams are having.
- [28:32]
A
Yeah, some of the best security teams are using AI to collate a whole bunch of data and then analyze it to see if there's risk in there. So you can start to piece together throughout the hiring lifecycle. You have all these places where you can collect data. Once you collect that data, you can use AI to do a first pass, for instance, to find, hey, here are some of the instances where there might be elevated risk that we would want humans to review. The other thing is, AI is pretty good at detecting these things. Not necessarily generative AI, but AI that's trained to detect deepfakes, for instance, are still very, very, very effective. If you have a way to make sure that you're gathering that data and feeding it to the appropriate places, then you can keep pace and you can figure out where there's risk before they get into your company.
- [29:22]
B
So something that I've been struggling with over the last few years is this idea of pulling yourself up, having an open mind, learning as an individual, and then building systems and thinking about things from a systems design standpoint. And as you're talking about this, I'm struck by the idea that organizations are being asked to individually come up with ways of keeping up with a fast moving threat actor, you know, a highly motivated threat actor, and that we need a systems design approach. And I know that the latest UN SMT report explicitly calls on member states to exercise vigilance and provides clear recommendations to counter this threat. But I'm curious, what can governments and international organizations do to help counter the threat at that systems level? Something that's a global policy or a collaboration across borders, because it doesn't seem like these threat actors particularly care where they're attacking, who they're attacking and what the rules of engagement are in a organization or in a geo.
- [30:38]
A
Yeah, so UN I think did a really good job and we helped them with this report. This multi state sanctions monitoring team was able to go in and say, hey, here's kind of the full spectrum of the attacks from start to finish. And what we found is that there's a lot of opportunity for collaboration, cross border collaboration, cross organizational collaboration. And I would say some of the biggest intelligence wins that we in the security community have had were because of collaboration between security teams. So the more that we're able to talk to each other candidly about some of these threats and what we're seeing, the better we'll be able to structure our defenses. For the nation state perspective, when, when you are a government and you want to go after these things, there's a few nice advantages. One is that a lot of this stuff still starts in the traditional banking system. In the traditional banking system, things don't move as fast and we have better controls. So if you can empower victims to come to you and quickly triage things, I think there's better chance that you can stop money from flowing into North Korea. And then even if things have left your borders, for instance, if you have good relationships with other countries around the world that are willing to collaborate, that want to improve the cyber posture of their country and their communities, then I think you can get to a point where we're collaborating a lot on what sort of infrastructure they're using to funnel money out of kind of the free world and into North Korea.
- [32:16]
B
So let's look ahead a little bit. How do you see this IT worker threat evolving in the next few years?
- [32:22]
A
Yeah, I'd expect more of the same. It's going to be higher pace, it's going to be higher volume. They're going to still go after more jobs now. They'll be going after, we've seen them expand out of just remote jobs, for instance, to proliferate into hybrid jobs, in person jobs. I expect that to continue because for them this is, this is a necessity. They make their money, they're surviving off of this. And for the individuals that are perpetrating the scam, this is, they are judged on how much money they're able to bring in and necessarily they will be creative about this. So expect the threat to stick around for a long time and expect it to get more accelerated and more targeted. That doesn't mean that there's nothing to do about it. I think a lot of the collaboration we haven't built the muscle to talk amongst teams, to talk amongst companies, to talk amongst industries, and even to talk amongst countries about this threat. So building that muscle of saying, hey, here are some network indicators that you should watch out for and be able to share that with someone who's able to share it widely in an anonymized context might be really helpful towards preventing one attacker from being able to have six jobs around the country to just keeping them limited to one at a time, for instance, so we can slow down the volume. And really, I think there's an opportunity for us to just improve our baseline detections, especially in the HR space, because frankly, it's going to be a space that is increasingly targeted as AI proves out that our hiring model is in some ways just fundamentally vulnerable.
- [34:00]
B
Evan, thanks for a great conversation today. I really appreciate you getting deep into your insights around the North Korean IT worker threat and talking to us about what organizations can do to mitigate this ongoing problem.
- [34:15]
A
Of course, thank you for having me and for everyone out there. Please keep safe and good luck.
- [34:21]
B
Evan, if folks want to reach out to you about the blogs that you've written and or the reports that you've contributed to or led, where can they find you on the Internet?
- [34:31]
A
I'm on LinkedIn. I'm not terribly active, but feel free to shoot a message there and I'll get back to you.
- [34:44]
B
Foreign. That's it for today. If you like what you heard, please subscribe wherever you listen and leave us a review on Apple Podcast or Spotify. Those reviews and your feedback really do help me understand what you want to hear about. If you want to contact me directly about the show, email me at threatvectorloaltonetworks.com I want to thank our executive producer, Michael Heller, our content creator and production teams, which include Kenny Miller, Joe Bacourt and Virginia Tran. Original music and mix by Elliot Peltzman. We'll be back next week. Until then, stay secure, stay vigilant. Goodbye for now.
- [35:36]
A
Sam.