DPRK IT WORKERS EXPANDING IN SCOPE AND SCALE

Summary from the TLDR InfoSec newsletter

DPRK IT workers have expanded operations globally, especially in Europe, by masquerading as legitimate remote workers to infiltrate companies and generate revenue for North Korea. They employ deceptive tactics such as fake personas, falsified credentials from institutions like Belgrade University, and blockchain projects in the UK, using facilitators in the US and UK to bypass identity verification. Since October 2024, they have increased extortion attempts against former employers, threatening to release sensitive data post-termination, and have started targeting virtualized BYOD environments where traditional security monitoring is harder.