DOJ announces actions disrupting North Korean remote IT worker scheme

The Department of Justice Oct. 13 announced a series of actions disrupting a scheme by the North Korean government that involved placing remote IT workers in U.S. companies to conduct malicious activities on the government’s behalf. The scheme involved North Korean IT workers posting fake job openings on job boards as remote freelance positions with requests such as interviewing on an individual’s behalf or receiving and hosting laptops in an individual’s home. The IT workers have been known to routinely elaborate stories, create fake companies and produce official documentation to appear credible. The DOJ’s actions include an indictment, two arrests, searches of multiple known or suspected laptop farms in Texas, and a seizure of approximately 187 computer devices used by the IT workers. The scheme impacted more than 70 U.S. companies and generated approximately $3 million in stolen revenue. The threat actors are also known to steal sensitive company data and have threatened to post it publicly unless they receive a large lump-sum payment. The DOJ said victims include companies in healthcare, as well as communications, cyber support, retail and manufacturing. The FBI said it observed IT workers using stolen identities, extortion and threats of physical violence to demand payments. The FBI provided recommendations for individuals and companies to protect themselves from potential IT workers involved in the scheme.
 
For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.