- Google’s Threat Intelligence Group has identified more threats from the DPRK
- North Korean hackers pose as IT workers to get jobs in Western firms
- This brings a host of security threats for companies
A new report by Google’s Threat Intelligence Group has warned of an expansion of operations by the Democratic People’s Republic of Korea (North Korea).
The researchers claim an increasing number of Western firms accidentally hiring North Korean IT workers who are raising funds for the regime.
These workers pose a serious security threat to organizations, which are at risk of data theft, disruption, and espionage.
Extortion tactics
This is part of a much wider campaign from the DPRK which has seen state-sponsored threat actors infiltrate dozens of Fortune 100 companies, resulting in as much as $6.8 million in revenue earned for the DPRK.
This led to the US Justice Department arresting several US citizens who were running ‘laptop farms’ which house US equipment sent to new employees – the facilitators installed remote access technology allowing workers from the DPRK to log in.
Google also located facilitators in both the US and UK sharing equipment, indicating a “complex logistical chain”.
An investigation into the campaign’s infrastructure revealed a ‘heightened interest in Europe’, and a global expansion of tactics from the DPRK and an increased volume of extortion attempts.
The threat intelligence group identified cases where recently fired IT workers “threatened to release their former employers’ sensitive data or to provide it to a competitor” including proprietary data and source code for internal projects.
To combat this phenomenon, Google reports that many companies are operating a bring your own device policy , but these often lack traditional security and logging tools and make threat detection much more difficult, dramatically increasing a risk in undetected malicious activity.
“The increase in extortion campaigns coincided with heightened United States law enforcement actions against DPRK IT workers, including disruptions and indictments. This suggests a potential link, where pressure on these workers may be driving them to adopt more aggressive measures to maintain their revenue stream.
Leave a comment