Suspected North Korean IT workers reached onboarding at companies with open data
Summary: Material Security tracked suspected North Korean fake IT workers through hiring pipelines and counted 27 personas that reached onboarding over one year, out of 2,429 that made contact and 1,100 that reached an interview or later. At one of four companies where a persona reached onboarding in the past 30 days, about 400,000 files with Social Security numbers and 345,000 with bank or routing numbers were present, with 68% and 71% respectively open to any company account or anyone with a link.
Bottom line: Any of the 27 who received credentials walked in trusted, provisioned, and hostile from day one, and at one company a new hire would have needed nothing more than a login to reach hundreds of thousands of open financial and identity files.
Read the original at Help Net Security ↗