North Korean IT Scammers Targeting European Companies

North Koreans posing as remote IT workers have spread the scam into Europe, where one Pyongyang fraudster assumed at least 12 personas to target companies in Germany, Portugal and the United Kingdom.

See Also: A Matrix on Behavioral Biometrics and Device Fingerprinting

Researchers from Google Mandiant said Tuesday the worker actively sought employment within the defense industrial base and government agencies. “This individual demonstrated a pattern of providing fabricated references, building a rapport with job recruiters and using additional personas they controlled to vouch for their credibility,” the threat intel firm wrote.

Western companies have grappled for years with the prospect of unintentionally hiring a North Korean national posing as someone else. Workers from the world’s only totalitarian hereditary communist monarchy have wormed their way into companies as freelancers and remote workers, where they’ve extorted their employers, stolen intellectual property and may have left digital backdoors for later exploitation. Money from scams that include forced labor in Chinese factories, cigarette smuggling and cryptocurrency hacking fund development of weapons of mass destruction. The United States government has responded by busting laptop farms enabling the scam, indicting and sanctioning the perpetrators.

Companies in the United States continue to be the main target but activity in Europe demonstrates the expanding “scope and scale” of the North Korean hackers, Mandiant said. North Koreans used job hunting sites such as Upwork and Freelancer, posing as job seekers with expertise in blockchain, artificial intelligence and web development.

“What we’re now seeing in Europe in part probably represents some successful efforts at disruption in the United States, but it also means that this is now a much more global problem that we are seeing,” said Luke McNamara, deputy chief analyst at Mandiant.

The report added the North Korean operations in Europe have been run by “facilitators” located in the United Kingdom or the U.S. In one case, a facilitator mixed up laptops, using a machine intended for use in New York for a campaign in London.

The North Korean government withholds up to 90 percent of the wages earned by IT worker scams, which the U.S. federal government estimates generated millions of dollars annually.