North Korean Job Fraud Extends Beyond IT to Healthcare and Sales Sectors

Expansion of Fraudulent Employment

Threat actors linked to North Korea are expanding their fraudulent job-seeking activities beyond the information technology (IT) sector. Recent investigations have identified suspected North Korean workers employed in sales and marketing and the medical profession, indicating a diversification of their targets.

The IT Worker Scheme

This ongoing insider threat is part of the "IT worker scheme," where North Korea utilizes its network of skilled workers to fraudulently secure remote jobs in global companies. The income generated from these positions is then used to fund Pyongyang's nuclear weapons and ballistic missile programs. This scheme involves using stolen or forged identity documents, VPNs, and proxy services to conceal their true identities and locations.

Detection Challenges and Case Examples

North Korean workers present a unique detection challenge because they trick companies into hiring them and often perform legitimate work. One case involved three employees at an Australian healthcare company flagged as North Korean impersonating Chinese individuals due to repeated VPN/proxy connections, fraudulent identity documents, and anomalies in proof of residence. Another case at a financial services firm uncovered the use of PiKVM, a device previously associated with the North Korean IT worker scheme, allowing remote access to devices on laptop farms.

Broader Implications

The expansion into non-IT sectors like healthcare and sales suggests a wider net cast by North Korean operatives to secure foreign currency. This development requires companies across various industries to enhance their vetting processes and be aware of the sophisticated methods used by these threat actors to infiltrate their workforces.