Not So Secure: Cybersecurity Firm Hired North Korean Hacker who Faked Identity with AI

KnowBe4, a prominent cybersecurity firm, recently uncovered a sophisticated infiltration attempt by a North Korean “threat actor” who posed as a remote software engineer on their internal IT team. The North Korean spy, after being hired, immediately began uploading malware to the company’s systems. CyberScoop reports that KnowBe4, a leading cybersecurity firm, has exposed an intricate
Not So Secure: Cybersecurity Firm Hired North Korean Hacker who Faked Identity with AI

KnowBe4, a prominent cybersecurity firm, recently uncovered a sophisticated infiltration attempt by a North Korean “threat actor” who posed as a remote software engineer on their internal IT team. The North Korean spy, after being hired, immediately began uploading malware to the company’s systems.

CyberScoop reports that KnowBe4, a leading cybersecurity firm, has exposed an intricate scheme by a North Korean threat actor who successfully infiltrated the company by posing as a remote software engineer. The incident, detailed in a blog post by KnowBe4’s founder and CEO Stu Sjouwerman, highlights the evolving sophistication of cyber threats and the pressing need for enhanced security measures in hiring processes.

The threat actor managed to bypass KnowBe4’s seemingly thorough interview process, which included background checks, verified references, and four video conference-based interviews. The deception was executed using a valid identity stolen from a U.S.-based individual, further enhanced by the use of a stock image augmented by artificial intelligence.

The ruse began to unravel when KnowBe4’s InfoSec Security Operations Center team detected suspicious activities from the new hire. On July 15, the company flagged malware loaded onto an Apple laptop sent to the remote worker. Simultaneously, the AI-filtered photo used by the imposter was identified by the company’s Endpoint Detection and Response software.

Quick action by the SOC team led to the containment of the fake worker’s systems after they ceased responding to outreach. During a brief 25-minute window, the attacker engaged in various malicious activities, including manipulating session history files, transferring potentially harmful files, and executing unauthorized software. Sjouwerman noted that the attacker utilized a single-board computer Raspberry Pi to download the malware.

Following the incident, KnowBe4 shared its findings with the FBI and Mandiant, a Google-owned cyber firm. Their collaborative investigation concluded that the worker was a fictional persona operating from North Korea.

The sophisticated scam involved connecting the fake employee’s workstation to an “IT mule laptop farm” and using a VPN to work night shifts, creating the illusion of being logged on during normal U.S. business hours. This setup allowed the threat actor to perform actual work while funneling a significant portion of the earnings to North Korea to fund illegal programs.

Despite the intrusion’s complexity, Sjouwerman assured that no illegal access was gained, and no data was compromised or exfiltrated from KnowBe4’s systems. He attributed the incident to a highly sophisticated threat actor who exploited weaknesses in the hiring and background check processes.

Read more at CyberScoop here.

Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship.

Total
0
Shares
Leave a Reply
Related Posts
It’s Tom Poo-gendhat! Tory leadership hopeful Tugendhat ‘forced to change his campaign slogan after it was discovered to spell T-U-R-D’
Read More

It’s Tom Poo-gendhat! Tory leadership hopeful Tugendhat ‘forced to change his campaign slogan after it was discovered to spell T-U-R-D’

Tory leadership hopeful Tom Tugendhat was forced into a last-minute change to his campaign slogan following a massive blunder, it has emerged. The former security minister last night launched his bid to replace Rishi Sunak and claimed he could lead the Conservatives to victory at the next general election. But, according to the Guido Fawkes blog
Chilling moment hooded and masked figure paces outside house 20 minutes before two children were stabbed to death at Taylor Swift-themed dance workshop – as footage shows armed police preparing to raid the same property hours later
Read More

Chilling moment hooded and masked figure paces outside house 20 minutes before two children were stabbed to death at Taylor Swift-themed dance workshop – as footage shows armed police preparing to raid the same property hours later

Chilling footage has emerged of a masked figure pacing outside a house that police raided after a knifeman killed two children at a Taylor Swift-themed dance workshop in Southport. The person, wearing a green hoodie and a Covid-style face mask, can be seen walking back and forth outside the front door of the property around