North Korean remote workers are broadening their job hunt beyond IT

North Korean (DPRK) remote workers are expanding their job searches beyond IT, according to Huntress. Recent investigations have identified suspected DPRK workers employed in sales and marketing and the medical profession.

“DPRK workers present a unique detection challenge for defenders: rather than compromising accounts or breaking in via gaps in the organizations’ environments, they’re tricking companies into remotely hiring them, and oftentimes actually doing the legitimate work they were hired to do,” Huntress said.

“Furthermore, DPRK workers often use stolen identity documents, VPNs, and proxy services to mask their true identity and location, meaning other methods must be used to help verify if an employee is who they say they are,” they added.

Fake passports built from the same template

In the Australian healthcare case, Huntress pulled six months of login records and found the three accounts repeatedly connecting through Astrill VPN and IPRoyal Proxy. Less than 50% of their activity happened during normal business hours, and their busiest period lined up with 9 a.m. in North Korea.

Two of the workers had uploaded a resident ID card, a passport, and an electricity bill to prove who they were. The passports were issued in the same city one day apart. The ID cards carried identical validity dates and the same issuing police station. The photos were shot at similar angles using the same phone model, minutes from each other.

“Although both individuals had unique photos showing the rear of their resident identity card, it also appears likely that both individuals accidentally used a photo of the same resident identity card rear based on some visible damage consistent across both photos.”

The electricity bills contained the same typos and appeared to have been based on a template available online. The researchers noted that the errors could have resulted from a translation issue if optical character recognition was used to turn an image into an editable template.

Word anomalies in electricity bill (Source: Huntress)

“Despite the likelihood of passports and resident identity cards being fraudulent, there’s still the possibility that these documents contained legitimate information or pictures from others who have had their identity information stolen or borrowed,” they noted.

Hardware that lets someone else run your laptop

A second case, at a financial services firm, involved a device rather than a document. Investigators found a PiKVM, an open-source, Raspberry Pi-based KVM-over-IP device that plugs into a computer and lets someone operate it remotely, connected to a new hire’s laptop within hours of it reaching a residential address.

Windows logs showed the machine had moved from the managed service provider’s network to a travel router, then to a home Wi-Fi network called “Pickle_Rick,” before landing on a fixed Ethernet connection. The sequence could indicate that the laptop had become part of a laptop farm, according to the investigation.

The same laptop had a Guermok USB capture card attached.

“This device registered as a webcam on the machine, and enabled any video streaming through it to be sent as a webcam input in web conferencing applications such as Zoom. The Guermok device is a supporting hardware anomaly that by itself is not evidence of DPRK involvement. However, it becomes significant because it co-occurred with a PiKVM, which we saw during this incident and across others,” researchers noted.

The worker also downloaded an altered photo taken from another person’s GitHub profile, potentially for use on an internal communications tool.

When the company asked to see the room the employee was working in, the worker refused and was reluctant to appear on camera. The investigation left the individual’s identity “questionable.”

Identity documents with a swapped photo

At a separate partner organization, a sales and marketing hire who had been onboarded 13 days earlier appeared to have used another person’s identity information with the photo swapped out.

Investigators found a police mugshot of a person whose name, date of birth, and location matched the information in the identity documents. The person in the mugshot did not match the photo on the submitted ID. The identification numbers passed validation checks, suggesting the documents contained information belonging to an existing person and had been digitally altered.

“The threat of DPRK remote workers isn’t going anywhere, due in part to the challenges of actually detecting this type of threat.”

“Mitigating the risk of fraudulent workers begins at the interview stage and continues with performing rigorous background checks of new hires prior to onboarding. When in doubt, performing standard background checks, searching the individuals online, and verifying any employment history will help to weed out DPRK workers early in the interview process,” the researchers concluded.