US DoJ and Microsoft Target North Korean IT Workers – Source: www.infosecurity-magazine.com

The US Justice Department has announced coordinated action against persistent North Korean attempts to find jobs in the country for its IT workers.

Announced yesterday, the operation included:

• An indictment charging several Chinese and Taiwanese nationals and one US citizen, Zhenxing “Danny” Wang of New Jersey, who was arrested. They are accused of working from 2021-2024 to facilitate remote IT work at over 100 US companies, including many Fortune 500 firms. They allegedly did so by using compromised US identities and enabling the IT workers to log in to US-based laptops. They also used shell companies to make it appear as if the workers were affiliated with legitimate US organizations. The facilitators received almost $700,000 for their help, while the scheme itself caused costs of at least $3m in legal fees, computer network remediation, and other damages and losses. In one case an IT worker gained access to sensitive employer data and source code related to AI technology used by a defense contractor.
• A second indictment, charging four North Korean nationals with a scheme to steal $900,000 in virtual currency from two firms and launder the proceeds. They worked from the UAE as a co-located team for an Atlanta-based blockchain research company and a Serbian virtual token business. The four, who remain at large, hid their true identities from their employer.
• Searches of 29 known or suspected “laptop farms” across 16 states. These are suspected of being used in North Korean schemes to hide the true location of remote IT workers.
• The seizure of 29 financial accounts used to launder illicit funds in the first scheme and 21 fraudulent websites.

“The threat posed by DPRK operatives is both real and immediate. Thousands of North Korean cyber operatives have been trained and deployed by the regime to blend into the global digital workforce and systematically target US companies,” said Leah Foley, US attorney for the District of Massachusetts.

“We will continue to work relentlessly to protect US businesses and ensure they are not inadvertently fueling the DPRK’s unlawful and dangerous ambitions.”

Separately, Microsoft revealed yesterday that it has suspended 3000 consumer grade Outlook and Hotmail accounts linked to suspected North Korean IT worker schemes – as well as alerting customers to the incidents via Microsoft Entra ID Protection and Microsoft Defender XDR.

It tracks this activity mainly as Jasper Sleet (formerly known as Storm-0287), Storm-1877 and Moonstone Sleet. 

Read more on North Korean IT workers: North Korea Escalates Fake IT Worker Schemes to Extort Employers

Facilitators to the Fore

These schemes typically begin with the procurement of stolen or rented IT worker identities, before opening mail accounts and social media pages (especially LinkedIn) to apply for jobs – sometimes indirectly through staffing or contracting companies.

They might also apply for freelance roles, using the same names and personas each time, and resumes are always faked to align with job requirements.

Communication, networking and developer platforms like GitHub are used to showcase ‘portfolios’ of previous work.

The tech giant claimed that facilitators like the ones mentioned above play a key role in enabling this kind of fraud.

“Facilitators play a crucial role in validating fraudulent identities and managing logistics, such as forwarding company hardware and creating accounts on freelance job websites,” Microsoft explained.

“To evade detection, these workers use VPNs, virtual private servers (VPSs), and proxy services as well as RMM tools to connect to a device housed at a facilitator’s laptop farm located in the country of the job.”

Microsoft said it has observed Jasper Sleet advertising jobs for facilitators under the guise of partnering with a remote job candidate to help get them an IT role. As well as the above tasks, they may be asked to create a new bank account or purchase SIM cards for the worker.

AI is another popular tool for these state-backed fraudsters, Microsoft said. The technology is used to polish fake resumes, manipulate images of the workers and even help them experiment with voice-changing software.

Microsoft has published a lengthy list of investigation, monitoring and remediation tips for companies.