{"id":57432,"date":"2024-10-18T04:28:12","date_gmt":"2024-10-18T04:28:12","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/biz-hired-and-fired-a-fake-north-korean-it-worker-then-the-ransom-demands-began\/"},"modified":"2024-10-18T04:28:12","modified_gmt":"2024-10-18T04:28:12","slug":"biz-hired-and-fired-a-fake-north-korean-it-worker-then-the-ransom-demands-began","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/biz-hired-and-fired-a-fake-north-korean-it-worker-then-the-ransom-demands-began\/","title":{"rendered":"Biz hired, and fired, a fake North Korean IT worker \u2013 then the ransom demands began"},"content":{"rendered":"

It’s a pattern cropping up more and more frequently: a company fills an IT contractor post, not realizing it’s mistakenly hired a North Korean operative. The phony worker almost immediately begins exfiltrating sensitive data, before being fired for poor performance. Then the six-figure ransom demands \u2013 accompanied by proof of the stolen files \u2013 start appearing.<\/p>\n

Secureworks’ incident responders have come across this pattern during “numerous investigations,” we’re told. And “multiple” tactics used in these scams align with North Korea’s Nickel Tapestry crew, which relies on the fake IT worker schemes to line Kim Jong Un’s coffers. According to the US government, these illicit funds<\/a> contribute to the DPRK’s illegal weapons programs<\/a>.<\/p>\n

“The emergence of ransom demands marks a notable departure from prior Nickel Tapestry schemes,” Secureworks Counter Threat Unit research team remarked<\/a> in a report.<\/p>\n