Curious about the latest twist in insider threats? Learn about the infiltration of western firms by fake North Korean IT workers
28 Oct 2025
•
,
5 min. read
Imagine this: a North Korean worker manages to infiltrate a western firm, passing multiple interviews and checks. This isn’t a movie plot, but a real cybersecurity threat uncovered by KnowBe4 back in July 2024. The incident serves as a stark reminder that identity-based threats can come from within your own organization.
But how widespread is this issue, you might wonder? According to an FBI wanted poster, the threat has been ongoing since at least April 2017. ESET Research has linked the activity to groups like UNC5267 and Jasper Sleet. The impact has been felt by over 300 companies, including Fortune 500 firms, between 2020 and 2022 alone.
So, how do these fake workers manage to slip through the cracks? By creating or stealing identities, setting up fake accounts, and using sophisticated techniques like deepfake images and video. They even have foreign facilitators who assist in setting up the elaborate scam.
Spotting and Stopping the Threat
Preventing your organization from falling victim to such a scheme requires vigilance and a keen eye for detail. Here are some tips:
1. Identify fake workers during the hiring process
- Check the candidate’s digital footprint for inconsistencies and fake profiles.
- Verify their credentials and conduct video interviews to detect deepfakes.
- Look for red flags in their behavior and experience.
2. Monitor employees for suspicious activity
- Keep an eye out for unusual behavior, such as working odd hours or accessing files from questionable locations.
- Use insider threat tools to detect anomalies.
3. Contain the threat
- If you suspect a fake worker, limit their access and investigate their activities.
- Report the incident to law enforcement and seek legal advice.
After addressing the immediate threat, consider updating your cybersecurity training programs to educate employees on detecting potential threats. Combining human awareness with technical controls is key to safeguarding your organization.
