How to Spot Surging Insider Threat

Beware North Koreans posing as bona fide remote IT workers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The cash-starved Democratic People’s Republic of Korea is deploying legions of domestically trained workers to secure legitimate IT jobs to generate revenue for the Pyongyang-based regime, said Adam Meyers, head of counter adversary operations at CrowdStrike. The firm attributes many of these attacks to a group it tracks as Famous Chollima, referring to an East Asian mythological winged horse that the DPRK has adopted as a sign of its economic and development ambitions.

CrowdStrike said it discovered at least 120 such incidents last year, in many cases involving North Koreans “using forged identities and AI-generated LinkedIn profiles” to gain illicit employment for as long as possible. The information the firm gathered helped build U.S. indictments unsealed in January, charging North Koreans as well as suspected middlemen who ran deceptive “laptop farms” that kept workers’ corporate-issued PCs running in the U.S., while allowing them to remotely connect, often from China (see: US Sanctions North Korean Remote IT Worker Front Companies).

Meyers said some of the adversarial remote IT workers they identified had already been employed for 12 or 14 months without being spotted. Beyond monetizing the attacks via multiple salaries earned by each individual worker, in some cases the workers appeared to hand off their access to a sophisticated hacking team run by Famous Chollima that would deploy malware in support of economic espionage, he said.

In this video interview with Information Security Media Group, Meyers also discussed:

• Attackers’ use of highly industrialized processes to support a “high tempo” of adversarial remote IT worker operations;
• Laptop farms across the United States and Europe – including in the United Kingdom, Poland and Romania – designed to deceive targets;
• Tips for spotting attempted adversarial remote IT worker operations, including the need for better performance management of current IT employees.

Meyers leads the threat intelligence line of business for the company. He directs a geographically dispersed team of cyber threat experts tracking criminal, state-sponsored and nationalist cyber adversary groups across the globe and producing actionable intelligence to protect customers.