Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them

Summary: Unit 42 describes a DPRK-run scheme in which operatives use stolen or fabricated identities to take remote IT jobs at companies worldwide, with individual workers earning up to $300,000 annually and the North Korean government retaining up to 90% of those earnings. The operatives mask their location with VPNs, VPSs and proxy services, control company laptops through remote desktop tools like AnyDesk and RustDesk or hardware KVM devices such as TinyPilot and PiKVM, and rely on U.S.-based facilitators to receive equipment and sit interviews.

Key Takeaway: The wages from these remote positions total hundreds of millions of dollars a year and directly fund North Korea's weapons of mass destruction programs, so a single bad hire is both a data breach risk and a sanctions violation. Unit 42 calls identity verification the single best opportunity to stop this before network intrusion, which puts the burden on hiring controls rather than on the SOC.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Endpoint & Network Security
Related