North Korean fake IT worker scheme infrastructure uncovered

North Korea has been coordinating with Western partners, utilizing complex hierarchies, and harnessing an open-source message app to support its fake IT worker scheme, which was noted by the United Nations to have yielded almost $500 million in annual revenue for the country, reports Cybersecurity Dive.

Operations of the country's remote IT worker scheme entailed an ecosystem of recruiters and facilitators, as well as Western laptop farm and financial transfer brokers, with supervisors observed to be interested in IT workers with blockchain, WordPress, and .NET framework experience, according to findings from a joint Flare and IBM X-Force analysis. Researchers found that North Korean operatives have been asked to diligently record the time spent looking for IT jobs, as well as use the state-owned VPN NetKey and open-source IP Messenger tool, which complicates detection by Google, Discord, and other messaging platform providers.

"With the help of [W]estern collaborators, North Korean operatives have more capability to bypass traditional vetting processes such as identity verification and background checks," said researchers.