Inside North Korea - Spotting malicious remote IT applicants

The Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) has increasingly been targeting Western organisations to secure remote IT worker jobs in aerospace, defence, retail, and technology companies. This has been reported by Mandiant, CrowdStrike, and KnowBe4 all with observations and lessons learned from each of these sources. DTEX has had firsthand experience identifying an apparent DPRK IT Worker during the early stages of an interview process. While initial incidents have been focused on the technology sector, the DTEX investigations team have observed indicators that other industries are targeted.

The DPRK IT workers’ motivations include personal financial gain and state objectives using a technically proficient workforce observed by other intel companies to sometimes be working multiple remote jobs simultaneously. The nature of the positions they obtain often means the workers have elevated access to network resources and can freely modify code. This can lead to a raft of dire outcomes, including but hardly limited to IP theft, reputational damage, financial loss and disruption of critical services.

The significance of this threat from the DPRK cannot be understated. The unfolding of their current campaign highlights the long-term planning underway, which we are only beginning to see.

This session highlights DPRK’s focus on remote IT jobs and similar tactics used by other foreign adversaries to target critical infrastructure in the West, possibly with even more dangerous motives.

Analysing these cases, with our own experience, can help develop strategies to address the DPRK IT worker issue and strengthen an organisation’s overall insider risk management program.

This session will cover how to identify and remediate the high-risk indicators of DPRK infiltration.