Studying Fraudulent North Korean IT Workers
Researchers set up a fake start-up company to study fraudulent North Korean IT workers.
Comments
For Profit • October 28, 2026 9:30 AM
As Rontea notes, this is an insider threat.
Years ago, someone (American) was prosecuted for providing laptops to a North Korean laptop farm.
As Rontea implies, and past experience has shown, the North Korean operatives are spying and exfiltrating data. Login credentials of legitimate employees are valuable to North Korea, even if the particular North Korean operatives leave the company those logins provide a long-term presence. If any spies are caught working in a company, there needs to be a detailed review and changing all logins would be likely needed. As someone noted, to detect a North Korean during an online job interview, a key question is:
https://this.weekinsecurity.com/this-quick-question-can-still-expose-north-korean-spies-in-an-instant/
Clive Robinson • October 28, 2026 9:38 AM
@ Rontea,
With regards,
“Once these workers clear hiring, they’re inside your network with legitimate access.”
It’s a bot more serious than that…
Because sometimes the hiring organisation is not a stand alone entity…
That is quite often people are hired by what are agencies supplying workers in others software “supply chains”.
Which is a very easy way to blow “code signing” out of the water and render it completely useless yet “fully trusted”. Which myself and @NickP discussed on this blog something like a decade and a half ago.
The first really remembered occurrence of this due to all the noise it later caused was “SolarWinds Orion” that we believe was first active at or before September 2019.
lurker • October 28, 2026 1:36 PM
Good episode of “Search Engine” podcast on this topic https://www.searchengine.show/is-your-new-co-worker-secretly-north-korean
Clive Robinson • October 28, 2026 8:36 PM
@ Bruce, ALL,
With regards,
“Researchers set up a fake start-up company to study fraudulent North Korean IT workers.”
The “North Korean” aspect so often played to fanfare, flag waving and drum beats by the western ICT Sec industry kind of grinds my gears…
The reason is not that I have any love or sympathy of the North Korean system (in fact quite the opposite).
But that the “North Korean” aspect is now a “banner issue” which makes what is a way way more general and wider attack front, into something much more limited. Thus making corporate management make false assumptions about “supply chain attacks”.
That is,
“Are Indian H-1B workers –that some claim there are a million of working in the US– any more or less dangerous than North Korean workers?
The actual answer is in many cases by head count it is Indians…
They are looking for “high technology” to appropriate and exploit rather than money for their government.
Whilst the NK Gov will take what it can get in most cases they do not have the industry to take advantage of it. However money for their Treasury is always immediately usable.
But it does not matter what the reason for foreign workers is, they are all doing a country harm and often both countries. Because they are stoping citizens in that country developing needed “national skills” for the sake of “a quick buck” on the profit line to keep share holders allowing the managers bonuses…
Which is why certain Corporate Management types were so keen on AI systems… But have now mostly found that
“AI really does not pay or play well”.
It only has longterm ROI in certain very niche very constrained activities and usually requires experienced human oversight.
If this will ever change is open to debate, and I for one am not taking a bet on it because I really don’t expect to live that long.
freedom • October 29, 2026 5:31 PM
AI, It only has longterm ROI in certain very niche very constrained activities
Well, the “activities” that so called “AI” targets are (obviously illegal) surveillance, censorship, government propaganda, control and abuse of “citizens”, or in one word, techno-fascism.
Techno-fascism is now the foundation of western “democracy” so it seems to me that the scope of “AI” isn’t too niche or too constrained. “AI” looks more like widespread cancer.
Clive Robinson • October 29, 2026 7:11 PM
@ freedom,
You have a bit of a problem.
That is you are mistaking what the technology can implicitly do, and the purpose a “Directing Mind” puts it to actual use for.
A hammer is a “force multiplying device, and can be used for “bad” as in smashing things, or “good” as in driving in nails in construction work. Sometimes though what appears might appear “bad” is actually “good”, and vice versa.
It is a part of the “observer problem”. That is how an entity not involved with either the device or Directing mind views the resulting activity the device has been put to.
We most often see this with jury trials, where some time after an event that causes a “perceived harm to others”… The “Directing mind” in control of a “deterministic device” is examined and the level responsibility for what has occured.
There are certain things that get taken into account but they boil down to
1, Observation / sensing time.
2, Reaction / response time.
3, State of mind.
Because at the end of the day there are no accidents in a deterministic environment, only time or lack there of to sense and respond, or a deliberate choice to allow or cause harm.
Hence the interest in determining the state of the “Directing Mind” and if they responded in what an observer would consider a reasonable time.
However this changes when the device has some level of “agency”. The legislation behind this is the ages old notion of the keeping of animals as domesticated pets/working, livestock in yard or field, or wild life in an area owned or under control of a responsible person.
Much as the AI Tech bois do not want to answer legally for what their creations do ultimately that is what will happen.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Rontea • October 28, 2026 8:22 AM
Once these workers clear hiring, they’re inside your network with legitimate access. No zero-days needed—your HR process is the attack surface.