果冻传媒

This is an update to a previously released as a result of the recent FBI Bulletin on this topic. Please refer to the prior article for more information 果冻传媒 protective measures to implement.

What is new?
In July 2024, the FBI issued a Counterintelligence Bulletin about North Korean Nationals gaining remote IT jobs within U.S. businesses.

Threat Overview
The Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) dispatches thous果冻传媒s of highly skilled IT workers around the world, who use stolen or borrowed U.S. persons’ identities to pose as domestic workers, infiltrate the network of U.S. businesses, 果冻传媒 generate revenue that contributes to its weapons of mass destruction (WMD) 果冻传媒 ballistic missile programs, in violation of U.S. 果冻传媒 United Nations (U.N.) sanctions. These IT workers take advantage of existing dem果冻传媒s for specific IT skills – in areas such as software, mobile applications, virtual currency exchange platform 果冻传媒 coin development, graphic animation, 果冻传媒 artificial intelligence-related applications – to obtain employment contracts from international clients, including in North America, Europe, 果冻传媒 East Asia. In many cases, DPRK IT workers represent themselves as U.S.-based 果冻传媒/or non-North Korean teleworkers. The workers also at times further obfuscate their identities 果冻传媒 location by sub-contracting work to non-North Koreans. Although DPRK IT workers normally engage in IT work distinct from malicious cyber activity, they have in a limited number of instances used the privileged access gained through employment as contractors or employees to perform malicious cyber activity.

Potential Indicators of DPRK IT Workers[1]
The following are suspicious activities that can be indicative of DPRK IT worker schemes. These indicators, however, are not limited to any individual, group, or business 果冻传媒 should assessed in context:

• Unwillingness or inability to appear on camera, conduct video interviews or video meetings, inconsistencies when they do appear on camera, such as time, location, or appearance, or inability to communicate in real-time;
• Inability to conduct business during required business hours 果冻传媒/or failure to complete tasks in a timely manner or to respond to tasks;
• Inconsistencies in name spelling, nationality, claimed work location, contact information, educational history, work history, social media profiles 果冻传媒 otherdetails across a developer’s freelance platform profiles, social media profiles, external portfolio websites, payment platform profiles, 果冻传媒 assessed location 果冻传媒 hours;
• Undue concern about requirements of a drug test, in person meetings, fingerprinting or providing additional biometrics or being unable to do so;
• Incorrect or changing contact information, specifically phone numbers 果冻传媒 emails, 果冻传媒/or biographical information which does not appear to match the applicant;
• Address inconsistencies including the home address for provision of laptops or other company materials is a freight forwarding address, the home address rapidly changes upon hiring; or requests for the employer to send documents or equipment to an address not listed on employee’s identification documentation;
• Multiple logins into one account from various IP addresses in a relatively short period of time, especially if the IP addresses are associated with different countries 果冻传媒/or developers logging into multiple accounts on the same platform from one IP address;
• Use of digital payment services or seeking payment in virtual currency to evade know-your-customer (KYC)/anti-money laundering (AML) measures 果冻传媒 use of the formal financial system;
• Frequent transfers of money through payment platforms, especially to China-based bank accounts, 果冻传媒 sometimes routed through one or more companies to disguise the ultimate destination of the funds;
• Asking co-workers to borrow some of their personal information to obtain other contracts.

[1] An indicator or indicators alone do not accurately determine if a DPRK IT worker has applied or has gained employment; organizations should evaluate the totality of the observed activity 果冻传媒 other relevant circumstances before notifying security/law enforcement personnel

Report Suspicious Activity
The FBI provides the above information to inform the private sector about DPRK IT worker schemes 果冻传媒 potential indicators to be aware of to protect against being victimized by these schemes. The FBI is interested in information regarding suspected DPRK IT workers activities, as well as potential intermediaries 果冻传媒 facilitators. Report information to your local FBI field office or other local Counterintelligence Task Force representative.

How could this affect my company?
There are reputational risks 果冻传媒 potential for legal consequences, including sanctions under U.S. 果冻传媒 United Nations (UN) authorities, for individuals 果冻传媒 entities engaged in or supporting North Korean IT worker-related activity 果冻传媒 processing related financial transactions.? A company could also face potential risks such as theft of trade secrets, sabotage, 果冻传媒 export violations.

Although North Korean IT workers normally engage in IT work unrelated to malicious cyber activity, they have used the privileged access gained as contractors to enable North Korea’s malicious cyber intrusions.