Ryan McGeehan

DPRK has co-opted "Hiring the Hacker"

In this wonderfully detailed LinkedIn post, Stephen Schmidt (CSO @ Amazon) describes the trend where North Korean (DPRK) nationals land jobs in other countries. From there, the rogue employee collect wages, steals data, and extorts the victimized employer.

I have been working in security incident response roles for nearly twenty years. I've only heard of this trend post-pandemic, but immediately felt this trend would stick. It's just too smart of an attack to ignore.

Steve's post describes this problem for one of the world's biggest employers. My 2 cents, I see this firsthand with the companies I support. At very low hiring volumes. Small companies seem better at catching rogue candidates because they're so intentional with hiring. Regardless, rogue candidates keep showing up.

I believe malicious candidates are now an evergreen threat scenario. We will deal with variations of this attack forever. Attacks on the recruiting pipeline are simply too attractive to be solely pursued by DPRK.

First, pipelines are high velocity. Incentivized like a sales pipeline. Recruiters are excited to hire a candidate and push them through without a critical eye for warning signs.

Second, attackers easily impersonate any attractive candidate through social media. As Steve's post mentions, you can either compromise an existing person's social media or duplicate and impersonate. AI has made it dead simple to fully impersonate them over voice, video, and even deliverable work product.

Third, recruiting software is unprepared for serious candidate verification and investigation. I expect the major platforms will catch up since they're being slammed with this problem. In the meantime, both recruiting and security teams are struggling to reason about this threat.

Lastly, a company will literally onboard the threat. It's hard to even call these attacks an intrusion when you're congratulating the threat and scheduling their intrusion with a "first day" onboarding. This approach will always work.

Many of us are figuring out the best ways to reduce the risk of hiring the hacker. In-office verification is the gold-standard mitigation for this problem in the meantime, but this simply isn't good enough.

Further Reading