DPRK IT WORKERS IN OPEN SOURCE AND FREELANCE PLATFORMS

Summary from the TLDR InfoSec newsletter

This document details a two-month investigation by cybersecurity researchers who discovered North Korean IT workers infiltrating legitimate open-source projects, particularly through the freelance platform onlyDust. The researchers identified three leading actors (0xExp-po, bestselection18/Hiroto Iwaki, and aidenwong812/cryptogru812) who created elaborate false identities, manipulated commit histories, and received payments totaling at least $1,874 across 11 repositories while contributing 62 pull requests. The investigation highlights serious security risks, including potential supply chain attacks, as these DPRK IT workers often collaborate with North Korean hacking teams to identify targets and establish initial access for future attacks.