US authorities have uncovered a network linked to North Korea that infiltrated approximately 70 US companies. The network used fake employees to gain access to internal systems, according to sources.
North Korean operatives posed as IT workers, employing fabricated identities and sophisticated techniques. They utilized remote desktop software and frequently changed bank accounts for paychecks, as highlighted in FBI alerts.
The operation involved individuals presenting themselves as qualified specialists to secure job opportunities. Once hired, these fake workers accessed companies' internal systems, stealing information or exploiting vulnerabilities.
The FBI's alerts included red flags such as new employees using remote desktop software to control their work computer. Security experts recommend strengthening identity verification procedures and background checks.
The operation is part of a broader trend where North Korean IT workers exploit recruitment vulnerabilities for financial and intelligence gains. It has been attributed to groups like Famous Chollima and PurpleDelta.
North Korean operatives have been linked to at least five successful hires this year, according to security outfit Huntress. The Justice Department previously sentenced two US facilitators over a related scheme.