North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.
A joint investigation by Mauro Eldritch, Heiner García, and ANY.RUN hired suspected DPRK developers linked to Lazarus Group into controlled sandboxes, revealing forged IDs, remote-access tools, AI-assisted workflows, and VPN/VPS infrastructure. The FBI is investigating a North Korean remote IT worker who reportedly worked for a U.S. federal agency. The article outlines verification steps and indicators including VPS and AstrillVPN exit node IPs.
- Suspected Lazarus-linked developers hired into sandboxed virtual desktops
- Forged identity documents and AI-assisted interview behaviors observed
- FBI investigating DPRK IT worker at a U.S. federal agency
- DPRK-operated VPS and AstrillVPN exit node IPs disclosed
- Guidance on multi-signal identity verification for remote hires
- ATT&CK
- T1592 Gather Victim Host InformationT1589.002 Gather Victim Identity Information: Email AddressesT1098 Account Manipulation
- Vendors
- ANY.RUNAstrillVPN
- Products
- ANY.RUN Sandbox
- Threat actors
- Lazarus Group
- Victims
- U.S. federal agency
- Countries
- North KoreaUnited States
From the original article
5 min read at thehackernews.com
Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.