|
2024-07-27 Cyber
|
|
Not So Secure: Cybersecurity Firm Hired North Korean Hacker who Faked Identity with AI
|
[Breitbart] KnowBe4, a prominent cybersecurity firm, recently uncovered a sophisticated infiltration attempt by a North Korean “threat actor” who posed as a remote software engineer on their internal IT team. The North Korean spy, after being hired, immediately began uploading malware to the company’s systems.
CyberScoop reports that KnowBe4, a leading cybersecurity firm, has exposed an intricate scheme by a North Korean threat actor who successfully infiltrated the company by posing as a remote software engineer. The incident, detailed in a blog post by KnowBe4’s founder and CEO Stu Sjouwerman, highlights the evolving sophistication of cyber threats and the pressing need for enhanced security measures in hiring processes.
The threat actor managed to bypass KnowBe4’s seemingly thorough interview process, which included background checks, verified references, and four video conference-based interviews. The deception was executed using a valid identity stolen from a U.S.-based individual, further enhanced by the use of a stock image augmented by artificial intelligence.
The ruse began to unravel when KnowBe4’s InfoSec Security Operations Center team detected suspicious activities from the new hire. On July 15, the company flagged malware loaded onto an Apple laptop sent to the remote worker. Simultaneously, the AI-filtered photo used by the imposter was identified by the company’s Endpoint Detection and Response software.
Quick action by the SOC team led to the containment of the fake worker’s systems after they ceased responding to outreach. During a brief 25-minute window, the attacker engaged in various malicious activities, including manipulating session history files, transferring potentially harmful files, and executing unauthorized software. Sjouwerman noted that the attacker utilized a single-board computer Raspberry Pi to download the malware.
Following the incident, KnowBe4 shared its findings with the FBI and Mandiant, a Google-owned cyber firm. Their collaborative investigation concluded that the worker was a fictional persona operating from North Korea.
The sophisticated scam involved connecting the fake employee’s workstation to an “IT mule laptop farm” and using a VPN to work night shifts, creating the illusion of being logged on during normal U.S. business hours. This setup allowed the threat actor to perform actual work while funneling a significant portion of the earnings to North Korea to fund illegal programs.
Despite the intrusion’s complexity, Sjouwerman assured that no illegal access was gained, and no data was compromised or exfiltrated from KnowBe4’s systems. He attributed the incident to a highly sophisticated threat actor who exploited weaknesses in the hiring and background check processes.
U.S. Offers $10 Million Bounty for North Korean Hacker Accused of Stealing Military Secrets
[Breitbart] The U.S. State Department offers a $10 million bounty for information on a dangerous North Korean hacker known as Rim Jong-hyok. 
|
Posted by Skidmark 2024-07-27 00:00||
||
Front Page|| [11135 views ]
Top
File under: Commies
|
|
Posted by Procopius2k 2024-07-27 06:59||
2024-07-27 06:59||
Front Page
Top
|
|
Posted by ed in texas 2024-07-27 19:18||
2024-07-27 19:18||
Front Page
Top
|
|
20:42 Woodrow
20:19 swksvolFF
20:17 swksvolFF
18:46 Grom the Affective
18:40 DooDahMan
18:34 Frank G
18:25 Frank G
18:22 Grom the Affective
18:11 trailing wife
18:06 Hellfish
17:49 Grom the Affective
17:19 Abu Uluque
17:04 Abu Uluque
17:02 swksvolFF
16:48 Grom the Affective
16:46 Grom the Affective
16:46 Mullah Richard
16:05 swksvolFF
15:26 Procopius2k
15:23 NN2N1
14:59 Pancho Poodle8452
14:52 Rambler
14:51 Grom the Affective
14:41 Elmerert Hupens2660
|
