Linkedin False, Webx and Fiverr Linkedin profiles: Within the North Korea Computer Workers’ regime, Fortune 500 is wound

• A key component for a scheme developed by the north -coreans When it comes to remote work technology work is working with Americans on continental soil to serve as a facilitator or proxy, in exchange for heavy rates. An expert in cybersecurity raised as North -American willing to accompany with the plot of computer worker to learn the aspects and results of the United States authorities, have generated hundreds of millions for North Korea and has affected hundreds of Fortune 500 companies.

The message Aidan Raney sent to a Fiverrian profile that he learned was manned 24 hours a day by North Korea engineers Seeking to recruit American accomplice It was simple and simple.

“How do I get involved?” Asked Raney.

The five -word text worked, Raney said, and days later, the Farnsworth Intelligence founder was in a series of calls with his new North Korea Handlers. Raney spoke with three or four different people, all of which claimed to be named “well”, and it seemed that they did not realize that Raney knew he was treating several people and not just one person.

It was during the second call Raney asked quick fire questions to learn the most points to serve as a proxy for northern Korea Software developers batch like the north -Americans to get Technological jobs of remote work.

How could the northern engineers manage their workload? The plan was to use remote access tools to Webex to evade detection, said Raney Fortune. From there, Raney learned that you should send 70% of any salary that won in potential work to the goods with Crypto, Paypal or Payoneer while they were in charge of creating a doctorate Linkedin Profile for him as well as job applications.

The goods told Raney that they would make most of the bases, but needed to be presented at video meetings, morning aupses and searches. They even took the head of the head and turned it into a black and white photo, so it would look different from any of their floating images online, he said. The person cultivated using Raney’s identity was someone well stormed in the development of the geographical information system and wrote to his false bio that he had successfully developed ambulance software to keep track of the location of emergency vehicles.

“They essentially handle all work,” Raney said Fortune. “What they sought to do was use my real identity to avoid background checks and things like that, and they wanted it to be extremely close to my real life identity.”

The vast scam of North computer workers -Corean has been in force since 2018 and has generated Hundreds of millions in annual income For the Democratic People’s Republic of Korea (DPRK). In response to severe economic sanctions, RDPK leaders developed organized crime rings to gather intelligence to use them Crypto Heists and malicious software operations, as well as deploying thousands of software developers trained in China and Russia to achieve legitimate jobs According to the Department of Justice, hundreds of Fortune 500.

Computer workers have the order to send most of the salaries to North Korea. It Was not reported Workers with minor payments involved in the regime can maintain 10% of their salaries, while higher paid employees remain 30%. The UN estimated that workers generate $ 250 million to $ 600 million from salary a year. Money is used to finance the weapons of the North Korea’s mass destruction and the ballistic missile programs, according to the Department of Justice, FBIand Department of state.

In the last two years the DOJ has it accused Dozens of people involved in the regime, but cybersecurity experts say that the allegations have not deterred the lucrative computer scam. In fact, the scheme has grown most sophisticated Over time, and the North -Coreans continue to send numerous applications to open job publications through and to perfect the BIOS and North -American coaches through interview questions.

Bojan Simic, a founder of the HyPR verification identity firm, said that the appearance of social engineering has evolved and that North Korean engineers-and other rings of crimes that imitated the scam-use more and more public information to increase the past tactics that have worked for them. For example, computer workers will examine the employees of a company in Linkedin to learn their start dates, and then call a service with AI to mask their voice to reestablish their password. Once they come to the next security question, they will upload and call again once they know the answer to the next question, as the last four digits of a social security number.

“Two and a half years ago, this was a very manual process to make a human being,” Simic said. “Now, it is a totally automated process and the person will sound like someone who speaks like you.”

And not only the North -Americans North -Coreans are deeply. A safety agent for a Japanese bench told Simic that he was almost never cared for by the hackers who shout the desks and deceive employees to provide information because most pirates do not speak Japanese, who speak Russians or Chinese, recalled Simic.

“Now, suddenly, hackers can speak Japanese fluently and can use the IA to do it,” he said. Simic has completely increased the risk landscape of the way companies respond to these threats.

However, there are methods to strengthen contracting practices to take root employment applicants through false identities.

“Adding some friction to the process of verification of identity” of people applying for jobs will often cause northern engineers to pursue easier goals, Simic explained. He said that coinciding an IP location at a location of the phone and requires that the cameras are turned on with proper lighting can go a long way.

In the case of Raney, the lambs landed a job interview and used remote access to open the notes on the screen so that they could write answers to the recruiter’s questions during the discussion. The regime worked: a private contractor of the United States government made Raney a verbal offer for full -time job paying $ 80,000 a year, he said.

Immediately Raney had to turn around and tell the company that he could not accept the offer and that he was involved in an incident response investigation for a customer.

Finally, he let things die with the north Korea’s goods, but before he did, he spent some time trying to open. Asked about their families or time. He made a text message to the goods and asked if they spent time with family members during the holidays. They responded by saying that there was nothing better than spending time with loved ones, adding a wink emoji, which hit Raney so different from the way they usually responded. From the messages, and seeing that the people were on their shoulders and the rhythm behind during video calls, Raney concluded that his conversations were heavily controlled and the northern engineers -Coreans were constantly monitored.

Raney’s account was First report In Huminth, a substitute that covers the intelligence community. Before the national security journalist, Sasha Ingber, published his story, Raney sent north of Korea, a note saying, “Sorry. Please escape if you can.”

The message was never opened.

In response to a comment request, Linkedin is headed Fortune their update By fighting false accounts.

A spokesman for Fiverr said that the company’s trust and security team supervises vendors to ensure compliance and update their policies constantly to reflect the evolving political and social landscapes.

In a statement, Payoneer said Fortune The firm uses robust compliance and control programs to combat the challenge of RDPK operators, which are posed as computer consultants.

This story originally presented to Fortune.com

Source link