Abstract:
The U.S. Department of Justice recently issued a press release announcing a joint law enforcement action against North Korea's remote IT employment scam. These North Korean IT personnel pretended to be U.S. identities to obtain remote corporate jobs, and then connected company equipment through laptop farms located in the United States. The investigation shows that at least 70 U.S. companies are currently affected, with approximately $3 million in related IT work revenue flowing to supported North Korean entities. These North Korean IT employees may also be lurking in companies to steal confidential data or perform other destructive acts.
A growing number of laptop farms:
Since many years ago, North Korea has been secretly training IT workers, forging identities and resumes, and then seeking remote jobs from U.S. companies. After being hired through an interview (no offline interview or contact is required throughout the process), laptop farm operators help North Korean IT workers receive laptops sent by their employers, and then install remote control software for North Korean IT workers to log in remotely.
The number of such laptop farms is increasing. The so-called laptop farms refer to setting up multiple stands in garages or simple houses, and then placing laptops on the stands to keep them connected to the Internet and connected to power sources, so that North Korean IT workers can continue to access remotely through the network. These laptops are actually equivalent to springboards.
Of course, the purpose of these North Korean IT workers is not just to earn wages. North Korean hackers have previously forged information to join the Web3 project, and then used their authority to steal confidential data, steal funds or deploy ransomware, etc.
187 devices seized in law enforcement operation:
The indictment released by the U.S. Department of Justice shows that law enforcement agencies seized approximately 187 laptop computers, keyboards, monitors, and mouse control devices from more than 40 known or suspected laptop farm homes in Texas. Two U.S. citizens have been arrested by the FBI, and as many as 14 suspects have been indicted.
The FBI said that laptop farm assistance is now no longer limited to collecting and hosting computers: people are being paid to replace job applicants for interviews, verify identities, or keep company equipment connected to the Internet. Some IT work is even subcontracted to third-country personnel.
The agency recommends that companies continue to verify employee identities and access behaviors after recruitment and onboarding, and not trust employees solely on certain single indicators. Otherwise, North Korean IT workers may have devastating consequences after entering the company's internal network environment.
Comments