North Korean "Laptop Farm" IT Worker Scam Targets Multiple High-Profile Companies

Key Points:

• Major U.S. companies targeted by North Korean threat actors disguised as remote IT workers.
• Multiple individuals responsible for stealing millions of dollars have already been apprehended by U.S. authorities.
• Of the victims, a cybersecurity company called KnowBe4 was targeted in a sophisticated social engineering attack that involved using an AI-modified photo in a hiring application.
• Due to the severity of this campaign, the U.S. State Department has placed it under the Rewards for Justice (RFJ) program, offering up to $5 million for any information that may lead to the disruption of this campaign.

Summary

Several major U.S. companies, including Fortune 100 firms, have unknowingly hired North Korean IT workers using fake identities for remote roles, as part of a scheme orchestrated by a threat group tracked since 2018 as UNC5267. These workers, primarily based in China and Russia, are sent by the North Korean government to earn salaries