The North Korean fake IT worker scheme has become a familiar tale. A company performs a series of remote interviews with a seemingly perfect employee. Every question is answered correctly, they appear legit, and they’re onboarded onto company systems.

That’s when things start to go wrong. In cybersecurity firm Knowbe4’s case, the individual attempted to load malware onto their company-issued device before the business quickly shut it down.

But it’s becoming more difficult to spot and stop North Korean fake IT worker schemes. As organizations wise up to the technique, novel tactics are emerging. New research shows fake IT workers are taking their job hunt seriously, submitting as many as 60 applications per day.

Groups of North Korean IT workers, dubbed PurpleDelta by Recorded Future, created at least 22 fabricated personas, with job applications being made across a range of recruitment websites and platforms such as LinkedIn and Upwork.

In another recently documented case, workers linked to the Famous Chollima group have managed to get hired in at least five cases this year, according to security outfit Huntress.

It came as security agencies issued an alert after North Korean-backed cyber criminals were found posing as recruiters to target freelance IT workers.

WaterPlum – which targets software developers and IT professionals – has infected at least 30,000 devices in more than 100 countries. The group has stolen funds or account credentials from over 7,000 cryptocurrency wallets, raking in around $10.7 million.

How are fake IT worker schemes evolving, and what should businesses be doing to manage the threat?

Beyond the US

US companies such as KnowBe4 have long been a target for North Korean IT workers; however, data shows the threat is expanding to multiple countries.

Recorded Future’s research found that around 80% of companies targeted by fake IT worker placements were in North America, but adversaries were also applying to companies around the world. “Operations tend to prioritise targeting markets with established online recruitment processes and where remote working continues to mature in a post-pandemic world,” says Alexander Leslie, senior advisor at Recorded Future.

The aim is to gain an undetected foothold in Western businesses, particularly in organizations working in software services, staffing and consulting, and healthcare and biotechnology, he tells IT Pro.

“Once they are ‘employed’ they can access sensitive and confidential information that can be exploited for political and commercial gain.”

As remote work continues to be the norm, identity brokering, rented accounts and remote-access tools make it “difficult to distinguish a criminal from a genuine applicant”, says Javvad Malik, lead CISO advisor at KnowBe4.

While fake worker schemes aim to make cash for the North Korean regime, the risk extends beyond payroll fraud, he says.

“Once inside, these individuals may gain access to source code, customer data, intellectual property and wider corporate systems. Additionally, they can simply use their legitimate position to build a broader network and trust with individuals within and outside of the organization.”

Given the global nature of remote work, any organization that hires IT contractors without conducting in-person verification is “potentially exposed”, according to Tracey Hannan-Jones, consulting director in information security, UBDS Digital.

She describes how targeted companies face risks such as sanctions exposure, because when an organization unknowingly employs a North Korean IT worker, it is “almost certainly” violating international sanctions frameworks.

The penalties can be severe, “even where the violation was entirely inadvertent”, warns Hannan-Jones.

Novel techniques

As Recorded Future’s data shows, attackers are using new technology and techniques to keep schemes alive. For example, the PurpleDelta threat group is using identity-brokering services, account-renting via AnyDesk and multi-accounting tools.

More widely, AI has made fake IT worker schemes much easier for threat actors to carry out at scale, says Jake Moore, global cybersecurity advisor at ESET. “AI chatbots can help them to draft emails, documents and interview talking points that sound impressive, even if they aren’t fluent English speakers.”

While some AI platforms have put controls in place, many can be used to generate the fake identity documents essential for this type of espionage, according to Moore.

Advanced AI tools themselves are also improving, helping fake applicants to disguise themselves – even in live video interviews, says Moore. “Deepfake technology has come along leaps and bounds. Two years ago, publicly available tools looked like Snapchat filters and weren’t convincing at all. But real-time deepfakes are now highly convincing.”

Deepfake tools can also be combined with modulation software to change the applicant’s voice in real time. “This enables fake IT workers to pose as candidates from any country and background,” Moore explains.

AI-driven recruitment practices are amplifying the threat. While AI can help employers to sift through applications, it is also easy to manipulate, says Moore. This is especially true when an organization is targeted by a practiced group of fake IT workers, who will “understand hiring processes, know what AI systems are looking for and use their own AI tools to avoid being sifted out at an earlier stage”, Moore warns.

Prevention is key

Security firm Netskope has shared its experience of being targeted by a fake worker scheme. James Robinson, CISO at Netskope, tells IT Pro how a fraudulent applicant applied for an open role. “The application itself was strong, and the associated LinkedIn profile was legitimate, but there were small inconsistencies in the candidate’s history, as well as a throwaway Outlook email address.”

Sensing something wasn’t right, the interviewer asked some conversational questions about a city where the candidate claimed to have worked for several years. “The applicant could not give any specific details about local places – or even offer a more precise address beyond repeating the city name,” says Robinson. “When pressed, he panicked and ended the call.”

While questions such as this can help catch fake IT workers out, Robinson believes teams need to collaborate throughout the recruitment process. “HR, security and IT teams need to work together to verify identities, limit unnecessary access and look for behavior that doesn’t match what’s expected of a legitimate employee.”

Yet overall, the most effective way to root out fake IT workers is to insist on meeting the candidate in person. “Let them know early on that this will be part of the interview process,” advises Moore.

“This will make it crystal clear to the threat actor that they will not be able to infiltrate the organization. If the candidate is in another country, ask a trusted third party to meet them. It will be worth the expense for the peace of mind.”

Organizations should introduce proportionate identity and right-to-work checks, and verify employment and qualifications independently, says Malik. “Use whatever reasonable means they have to deliver equipment via secure channels and validate identity in person before handing over equipment.”

Hiring managers and recruiters need training to recognize inconsistencies and escalate concerns without creating bias or unfairly penalizing legitimate remote workers, according to Malik. “Managers need to be given an environment where they can safely raise any potential red flags.”