A North Korean Hacker Tricked a US Safety Vendor Into Hiring Him—and Instantly Tried to Hack Them

KnowBe4, a US-based safety vendor, revealed that it unwittingly employed a North Korean hacker who tried to load malware into the corporate’s community. KnowBe4 CEO and founder Stu Sjouwerman described the incident in a weblog publish this week, calling it a cautionary story that was happily detected earlier than inflicting any main issues.

“To start with: No unlawful entry was gained, and no knowledge was misplaced, compromised, or exfiltrated on any KnowBe4 programs,” Sjouwerman wrote. “This isn’t a knowledge breach notification, there was none. See it as an organizational studying second I’m sharing with you. If it might occur to us, it might occur to virtually anybody. Do not let it occur to you.”

KnowBe4 mentioned it was on the lookout for a software program engineer for its inner IT AI workforce. The agency employed an individual who, it seems, was from North Korea and was “utilizing a legitimate however stolen US-based id” and a photograph that was “enhanced” by synthetic intelligence. There may be now an energetic FBI investigation amid suspicion that the employee is what KnowBe4’s weblog publish referred to as “an Insider Menace/Nation State Actor.”

KnowBe4 operates in 11 international locations and is headquartered in Florida. It supplies safety consciousness coaching, together with phishing safety exams, to company prospects. Should you sometimes obtain a faux phishing e-mail out of your employer, you is perhaps working for an organization that makes use of the KnowBe4 service to check its workers’ capacity to identify scams.

Particular person Handed Background Verify and Video Interviews

KnowBe4 employed the North Korean hacker by means of its standard course of. “We posted the job, obtained résumés, carried out interviews, carried out background checks, verified references, and employed the individual. We despatched them their Mac workstation, and the second it was obtained, it instantly began to load malware,” the corporate mentioned.

Regardless that the photograph offered to HR was faux, the one who was interviewed for the job apparently regarded sufficient prefer it to move. KnowBe4’s HR workforce “carried out 4 video convention primarily based interviews on separate events, confirming the person matched the photograph offered on their utility,” the publish mentioned. “Moreover, a background test and all different normal pre-hiring checks have been carried out and got here again clear as a result of stolen id getting used. This was an actual individual utilizing a legitimate however stolen US-based id. The image was AI ‘enhanced.'”

The 2 photographs on the prime of this story are a inventory photograph and what KnowBe4 says is the AI faux primarily based on the inventory photograph. The inventory photograph is on the left, and the AI faux is on the suitable.

The worker, known as “XXXX” within the weblog publish, was employed as a principal software program engineer. The brand new rent’s suspicious actions have been flagged by safety software program, main KnowBe4’s Safety Operations Middle (SOC) to research:

On July 15, 2024, a sequence of suspicious actions have been detected on the person starting at 9:55 pm EST. When these alerts got here in KnowBe4’s SOC workforce reached out to the person to inquire concerning the anomalous exercise and doable trigger. XXXX responded to SOC that he was following steps on his router information to troubleshoot a velocity challenge and that it might have triggered a compromise.

The attacker carried out varied actions to govern session historical past recordsdata, switch probably dangerous recordsdata, and execute unauthorized software program. He used a Raspberry Pi to obtain the malware. SOC tried to get extra particulars from XXXX together with getting him on a name. XXXX said he was unavailable for a name and later turned unresponsive. At round 10:20 pm EST SOC contained XXXX’s gadget.

“Faux IT Employee From North Korea”

The SOC evaluation indicated that the loading of malware “might have been intentional by the person,” and the group “suspected he could also be an Insider Menace/Nation State Actor,” the weblog publish mentioned.

“We shared the collected knowledge with our pals at Mandiant, a number one international cybersecurity skilled, and the FBI, to corroborate our preliminary findings. It seems this was a faux IT employee from North Korea,” Sjouwerman wrote.

KnowBe4 mentioned it might’t present a lot element due to the energetic FBI investigation. However the individual employed for the job might have logged into the corporate pc remotely from North Korea, Sjouwerman defined:

How this works is that the faux employee asks to get their workstation despatched to an tackle that’s mainly an “IT mule laptop computer farm.” They then VPN in from the place they actually bodily are (North Korea or over the border in China) and work the night time shift in order that they appear to be working in US daytime. The rip-off is that they’re really doing the work, getting paid effectively, and provides a big quantity to North Korea to fund their unlawful applications. I haven’t got to let you know concerning the extreme danger of this. It is good we’ve got new workers in a extremely restricted space once they begin, and haven’t any entry to manufacturing programs. Our controls caught it, however that was positive a studying second that I’m comfortable to share with everybody.

This story initially appeared on Ars Technica.