Studying Fraudulent North Korean IT Workers

Rontea • October 28, 2026 8:22 AM

Once these workers clear hiring, they’re inside your network with legitimate access. No zero-days needed—your HR process is the attack surface.

For Profit • October 28, 2026 9:30 AM

As Rontea notes, this is an insider threat.
Years ago, someone (American) was prosecuted for providing laptops to a North Korean laptop farm.
As Rontea implies, and past experience has shown, the North Korean operatives are spying and exfiltrating data. Login credentials of legitimate employees are valuable to North Korea, even if the particular North Korean operatives leave the company those logins provide a long-term presence. If any spies are caught working in a company, there needs to be a detailed review and changing all logins would be likely needed. As someone noted, to detect a North Korean during an online job interview, a key question is:
https://this.weekinsecurity.com/this-quick-question-can-still-expose-north-korean-spies-in-an-instant/

Clive Robinson • October 28, 2026 9:38 AM

@ Rontea,

With regards,

“Once these workers clear hiring, they’re inside your network with legitimate access.”

It’s a bot more serious than that…

Because sometimes the hiring organisation is not a stand alone entity…

That is quite often people are hired by what are agencies supplying workers in others software “supply chains”.

Which is a very easy way to blow “code signing” out of the water and render it completely useless yet “fully trusted”. Which myself and @NickP discussed on this blog something like a decade and a half ago.

The first really remembered occurrence of this due to all the noise it later caused was “SolarWinds Orion” that we believe was first active at or before September 2019.