FBI Wanted List: Fraudulent Remote IT Workers from DPRK
fbi.govJust a couple of days ago, I received an email from our HR department requesting information about a recent hire. Basically, they asked if I or anyone on my team had physically met that person. My company still embraces remote work, and everyone on my team is remote. As luck would have it, the person in question lives near another team member and they had met up for a company function (once).
I assume that the request was related to something like this: Preventing fraudulent remote workers.
Remote jobs? In tech? In this job market? Credit where credit is due...
And, maybe I'm reading too far into it, but this line:
>With these roles, these individuals allegedly abused their access at the companies to steal virtual currency.
makes it sound like they were stealing Robux or something. Could money be laundered through re-selling video game currencies?
Sounds like a couple of crypto exchanges didn’t KYC their employees as hard as they do their customers and let them be too close to the casino vaults, as it were…
The sophistication of these guys is high. They're hiring US citizens to interview for them and then if they get hired, their work quality is high so they fly under the radar for awhile.
I wonder how complicit the companies are? They know "Jeff" is a fraud, but his code is great? ¯\_(ツ)_/¯
I've thought about the same thing. My company specializes in blocking candidate fraud and we have yet to see anyone who's sentiment isn't "get these people out of here".
Employing a North Korean can create sanctions and criminal risk, so it's not worth it.
From what I've heard from people who have accidentally hired them though, many are great engineers.
I do IT support for onboarding remote hires for a call center we catch about 1-2 hires a day who are fraudulent. Most we catch by comparing the photos on their DL to the person who shows up on webcam for training. It’s unclear the motivation for the fraud. I don’t think they really have dug into that yet.
Am I reading this right? They're in the U.S. somewhere? How did they get into the country? Do we still think low border security is a good idea?
Essentially, they steal US social security numbers or ITINs from leaked identities to apply for jobs in the US as US citizens. They then make money for prohibited countries like North Korea while pretending to be that citizen. The mony is exfiltrated through cryptocurrency or money mules. In the meantime they install malware and steal anything that isn't nailed down. Passwords, keys, proprietary documents, cryptocurrency, etc...
Edit: They also recruit US Citizens through "Work from home" schemes to help them engage in the fraud.
Can confirm, we're dealing with one right now.
They coast for a while on passable work but it isn't sustained through multiple warnings. The day after we hit him with a PIP he performed a mass exfiltration.
Two weeks after we let him go, systems he had previously had access to were compromised from outside.
With remote workers, if they start underperforming, start revoking whatever access you can at the first warning. Most of the events were set in motion once he saw the writing on the wall. This one was a textbook case with such predictable timing it's absurd that he got as far as he did.
He also raised every red flag in the book during the hiring process (interviewers noted suspicions of AI use) and presented as too good to be true with perfect skills alignment and low salary requirements. At every point in the process we knew better.
The majority of people in the country without documented status entered legally.
Seems like you didn't read it right.. The trouble with border security is that it is a very expensive way to get a misplaced sense of security.
> They're in the U.S. somewhere
Nope. UAE or Laos:
"The men speak English and Korean and have ties to the United Arab Emirates and Laos"
Honestly, impressive feat on their end.