Suspected North Korean IT workers reached onboarding at companies with open data
Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year.
Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year.
At one company where a persona got that far in the past month, about 277,000 files containing Social Security numbers were shared company-wide or by public link.
The personas are fabricated job seekers, complete with résumés and faces, applying for remote engineering roles.
A new hire there would have needed nothing more than a login.
The researchers saw 41% of personas at more than one organization, and in the past 30 days, 232 suspected personas contacted 99 organizations.
Material recommends pairing hiring controls with access controls, since a North Korean hire who gets through holds valid credentials.
That is roughly one in 90, a small share, but any of the 27 who received credentials walked in trusted, provisioned, and hostile from day one.
The first held about 15 million source-code files and 130,000 files with bank or routing numbers, shared with almost no one beyond their owners.
Over the year, 2,429 of them made contact, 1,100 reached an interview or later, and 27 reached onboarding, meaning offer letters, background checks, equipment requests, or first-day IT setup.
What happened
Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year.
At one company where a persona got that far in the past month, about 277,000 files containing Social Security numbers were shared company-wide or by public link.
The personas are fabricated job seekers, complete with résumés and faces, applying for remote engineering roles.
What changed
A new hire there would have needed nothing more than a login.
Who is affected
The researchers saw 41% of personas at more than one organization, and in the past 30 days, 232 suspected personas contacted 99 organizations.
Why it matters
Material recommends pairing hiring controls with access controls, since a North Korean hire who gets through holds valid credentials.
Technical details
That is roughly one in 90, a small share, but any of the 27 who received credentials walked in trusted, provisioned, and hostile from day one.
The first held about 15 million source-code files and 130,000 files with bank or routing numbers, shared with almost no one beyond their owners.
Response
Over the year, 2,429 of them made contact, 1,100 reached an interview or later, and 27 reached onboarding, meaning offer letters, background checks, equipment requests, or first-day IT setup.