North Korean remote workers are broadening their job hunt beyond IT
Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.
Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.
- DPRK workers expanding beyond IT into sales, marketing, and medical roles
- Passports issued in the same city one day apart; identical ID validity dates
- PiKVM plus USB capture card on a new hire's laptop suggests a laptop farm
- Worker refused to show their room and avoided camera in financial-services case
- Defenders advised to verify employment history and documents during interviews
- Vendors
- Huntress
- Products
- PiKVMGuermok USB capture card
- Threat actors
- North Korea (DPRK)
- Organizations
- Huntress
- Countries
- North KoreaAustralia
From the original article
3 min read at helpnetsecurity.com
North Korean (DPRK) remote workers are expanding their job searches beyond IT, according to Huntress. Recent investigations have identified suspected DPRK workers employed in sales and marketing and the medical profession.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.