In recent years, cybersecurity threats have often involved hackers stealing identities through various digital channels to gather sensitive information. However, a recent incident within the administrative environment of cybersecurity firm KnowBe4 has highlighted concerns about insider threats.
According to a blog post by KnowBe4, the incident unfolded when the company advertised a software engineer position for an AI development project and received applications from candidates worldwide. One applicant from the United States stood out to recruiters and was hired after successfully passing multiple interviews, including two video conferences.
Initially, everything appeared routine as the new employee was onboarded and provided with a Mac workstation via mail. However, the situation took a troubling turn when the company’s Endpoint Detection and Response (EDR) software flagged malicious activities on the device and network. These activities included unauthorized downloads of malware, transferring sensitive files to remote servers, and running espionage-related software.
Efforts to contact the employee were unsuccessful, prompting the Security Operations Center to isolate the device and launch an investigation. It was later revealed that the supposed IT worker was not genuine and had been manipulated to act on behalf of entities in North Korea. The objective was to infiltrate KnowBe4’s corporate environment, gain access to servers, and potentially deploy ransomware to extort funds. Additionally, funds were intended to support North Korea’s nuclear ambitions through an e-wallet linked to the regime.
Further investigation uncovered that the device sent to the fake employee had been redirected to a clandestine location, connecting to North Korean networks via a VPN.
In response to this incident, KnowBe4 has shared several tips to help organizations detect fraudulent IT worker scams:
a.) Conduct thorough background checks as soon as candidates submit their resumes, particularly for remote IT roles.
b.) Verify recommendations independently rather than relying solely on email correspondence, which can be falsified.
c.) Conduct video interviews for all stages of the hiring process to ensure the authenticity of the applicant.
d.) Monitor and restrict access to sensitive information and systems during the initial months of employment or project initiation.
e.) Implement robust access control and authentication measures for all new hires, especially during probation periods.
f.) Maintain close oversight of employee activities, particularly during training periods, and restrict access to critical IT infrastructure accordingly.
This incident serves as a stark reminder of the importance of vigilance and stringent security measures in protecting against insider threats and cyber espionage activities.
