12 minhigh
North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs
North Korean operatives, tracked under Lazarus/Famous Chollima, obtain remote IT and developer positions at Western companies and government agencies by combining stolen or synthetic identities, AI-generated documents, and layered network obfuscation (commercial VPNs and facilitator-operated 'laptop farms'). Once hired, operatives function as insiders with legitimate credentials and device access, and separately, malware samples such as a Python-based backdoor (newbeaver.py) have been observed being delivered through candidate technical assessments, connecting to dedicated C2 infrastructure that overlaps with known DPRK malware campaigns (BeaverTail/InvisibleFerret family). Defense requires integrating SOC-driven sandbox triage of candidate files, network telemetry analysis during interviews, and forensic document review into the hiring pipeline rather than relying solely on traditional background checks.
Sens:7d
IOCs33
15ip9url5domain2sha2561filename1md5
Detection / HunterAnthropic
What Happened
North Korean government-linked operatives are getting hired as remote IT workers and software developers at companies and even government agencies in the US and Europe by using fake identities, some of which are partly created with AI image tools. This affects any organization that hires remote technical workers, since these operatives use fake paperwork, hide their real location using VPNs, and sometimes get help from people who host laptops for them domestically so their internet traffic looks local. This matters because once hired, these workers gain real access to company systems and code for months or years, which can be used to steal money, steal data, or plant malicious code, and separately, some send malware-laced files during job interviews. Organizations should verify each job candidate individually (not through a team lead who vouches for others), check documents for signs of AI editing, monitor network connection details during interviews and remote work, and open any files or links candidates send inside a safe testing environment before opening them on real company computers.
Key Takeaways
- North Korean operatives obtain remote IT and developer jobs at Western companies and government agencies using AI-generated fake identity documents, gaining insider access rather than exploiting technical vulnerabilities.
- A single 'team lead' or facilitator often vouches for and refers multiple operatives, allowing them to bypass individual background checks if organizations do not enforce separate vetting per candidate.
- Operatives use commercial VPN services and 'laptop farms' operated by domestic facilitators to make remote connections appear to originate from legitimate US or EU residential addresses.
- Forged driver's licenses and identity documents submitted by candidates were found to contain metadata revealing they were processed with AI tools such as Google Gemini, including embedded SynthID watermarks.
- Malicious code samples submitted during technical assessments (e.g., a Python script named newbeaver.py) connect to attacker-controlled infrastructure to exfiltrate system information and receive commands, tying the scheme to known DPRK malware families such as BeaverTail and InvisibleFerret.
Affected Systems
- Corporate and government hiring/HR workflows for remote IT and developer roles
- Endpoints used to open candidate-submitted files, portfolios, and links during technical assessments
- Corporate laptops shipped to remote employees
- Payroll and cryptocurrency payment systems
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Operative applies for a remote IT/developer role using a stolen or AI-generated fake identity, sometimes recruited via mass outreach on GitHub or Telegram.
- Trust Establishment: A single facilitator or 'team lead' is hired first, then vouches for or refers additional operatives, bypassing individual vetting if permitted.
- Network Obfuscation: Operative connects through a commercial VPN service or a domestic 'laptop farm' with remote desktop access so traffic appears to originate from a legitimate local address.
- Malware Delivery: During technical assessments, the candidate submits code samples, portfolios, or links containing malware such as newbeaver.py, OtterCookie, InvisibleFerret, or PyLangGhost RAT.
- Command and Control: Delivered payloads connect to attacker-controlled servers to transmit system information and receive further commands.
- Monetization/Exfiltration: Once hired, salary payments and any stolen data or funds are routed through mule bank accounts and cryptocurrency wallets back toward DPRK-controlled infrastructure.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: ANY.RUN Threat Intelligence Lookup
The article references ANY.RUN's Threat Intelligence Lookup search syntax (e.g., a threatName-based query) as a way to pivot on Lazarus/Famous Chollima indicators, but no YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL rule content is provided in the article itself.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Candidate-submitted files and links are typically opened outside corporate EDR coverage until a hire is finalized, and operatives use their own or facilitator-controlled devices, limiting endpoint telemetry during the vetting phase. |
| Network Visibility | Medium | Organizations that actively monitor connection metadata during interviews and onboarding (e.g., via canary tokens, IP/User-Agent logging) can gain visibility into VPN and proxy use, but this requires deliberate instrumentation rather than passive monitoring. |
| Detection Difficulty | Hard | The core of this scheme relies on identity fraud and social engineering rather than a technical exploit, so it evades signature-based and most endpoint-based detection; identifying it requires cross-functional coordination between HR, recruiting, and the SOC. |
Required Log Sources
- VPN and network egress logs during video interviews and technical assessments
- Canary token or web beacon logs embedded in coding test links
- GitHub audit and discussion logs for unsolicited outreach patterns
- Sandbox execution and DNS request logs from candidate file triage
- HR/payroll systems logs for third-party or mismatched payment destinations
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for job candidates whose claimed residence, driver's license state, and bank/crypto account details are geographically inconsistent, which may indicate synthetic identity use. | HR intake records, KYC/identity verification documentation, payroll account details | Initial Access / Reconnaissance | Medium - legitimate candidates who recently relocated or have multi-state financial history could trigger false positives |
| Consider monitoring for network connections during interviews or remote onboarding that originate from known commercial VPN exit node ranges or exhibit inconsistent geolocation versus claimed residence. | Video conferencing platform IP/User-Agent logs, canary token hits, VPN provider IP ranges | Defense Evasion (T1090.002) | Medium - some legitimate remote employees use VPNs for privacy or security reasons |
| Consider hunting for candidate-submitted files or links that, when detonated in an isolated sandbox, initiate outbound connections to unfamiliar or newly registered domains shortly after execution. | Sandbox network/DNS logs, HTTP request logs from candidate file analysis | Command and Control (T1071.001) | Low - legitimate portfolio code rarely beacons out to external C2-style endpoints |
| Consider reviewing identity documents submitted during hiring for embedded metadata indicating AI generation or editing tools (e.g., C2PA/SynthID markers) using file metadata extraction. | Document metadata extraction output from submitted ID scans/photos | Resource Development / Initial Access | Low - legitimate ID scans rarely contain AI generation claim metadata |
| Consider flagging referral patterns where a single team lead or agency vouches for multiple developer hires without each undergoing separate direct verification. | HR/recruiting pipeline records, contractor agency referral logs | Persistence / Insider Access Establishment | Medium - legitimate staffing agencies also refer multiple candidates through one point of contact |
Control Gaps
- Traditional AV/EDR tools will not detect an insider threat operating with legitimate, issued credentials and hardware
- Standard automated background check services verify that an identity document exists but do not confirm the remote candidate is the person depicted in it
- Perimeter network controls will not catch VPN-obscured connections unless specific commercial VPN provider ranges are actively blocklisted
- Standard file-sharing/portfolio review during hiring is typically performed on unprotected corporate endpoints, missing sandbox-based detonation of submitted files
Key Behavioral Indicators
- Unsolicited recruitment or partnership offers submitted as pull requests or discussion comments on a developer's own GitHub repository
- A single hiring contact or team lead proposing to supply an entire pre-formed contracting team
- Candidate video calls exhibiting delayed responses to technical questions, off-screen glances, or sudden physical excuses coinciding with live AI translation tool glitches
- Identity document files containing AI-generation claim metadata (e.g., C2PA assertions referencing generative AI tools)
- Payroll or crypto payment requests directing funds to a third party or an account name that does not match the verified candidate identity
- Remote desktop software (e.g., AnyDesk, Google Remote Desktop) providing 24/7 access to a device from geographically inconsistent locations
False Positive Assessment
Medium - individual indicators such as VPN usage, referral-based hiring, or AI-assisted document processing are common in legitimate contexts, so hunting hypotheses and behavioral indicators described here should be correlated with multiple signals before escalation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response and hiring/vetting procedures before acting: consider requiring that all candidate-submitted files, portfolios, or links be opened only inside an isolated sandbox environment rather than on corporate endpoints.
- Consider enforcing direct, individual identity verification (KYC) for every developer candidate, even those referred or vouched for by an existing contractor or team lead.
- Consider embedding network telemetry collection (e.g., canary tokens) into coding assessments and interview links to help validate a candidate's claimed location.
- Consider cross-referencing candidate-submitted URLs, file hashes, and infrastructure against threat intelligence sources before finalizing a hire.
Infrastructure Hardening
- Evaluate whether commercial VPN provider IP ranges commonly used for identity obfuscation should be restricted or flagged during candidate interviews and onboarding sessions, where feasible for your environment.
- Consider integrating continuously updated threat intelligence feeds (IPs, domains, URLs) tied to known DPRK-linked infrastructure into SIEM, EDR, and firewall rule sets, subject to your existing change control process.
- Consider requiring separate, verified shipping and equipment-return addresses for remote hires to reduce the risk of 'laptop farm' style equipment diversion.
User Protection
- Consider training hiring managers and technical interviewers to recognize behavioral red flags such as unexplained call delays, avoidance tactics, or excuses tied to translation tool failures.
- Consider instructing staff who review candidate identity documents to check file metadata for AI-generation or editing artifacts using forensic tools, where your process allows.
- Where supported by your tooling, consider restricting the use of personal remote-access software (e.g., AnyDesk) on company-issued devices without prior security review.
Security Awareness
- Consider incorporating insider threat and hiring-fraud scenarios into existing security awareness programs for HR and recruiting staff.
- Consider briefing engineering managers on the risk of 'bring your own team' staffing offers and the importance of independent vetting for each referred developer.
- Consider periodically reviewing payroll/vendor payment change requests for signs of mule account routing as part of broader fraud-awareness training.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Resource Development
Tactic
Execution
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- Ips:
104[.]250[.]148[.]58- AstrillVPN exit node used by operatives to spoof US network location192[.]200[.]115[.]226- AstrillVPN exit node used by operatives to spoof US network location107[.]150[.]38[.]250- AstrillVPN exit node used by operatives to spoof US network location206[.]217[.]134[.]34- AstrillVPN exit node used by operatives to spoof US network location199[.]168[.]112[.]175- AstrillVPN exit node used by operatives to spoof US network location192[.]178[.]24[.]164- IP address observed communicating over port 443, linked to Lazarus/uasecurity infrastructure per TI Lookup211[.]239[.]117[.]117- IP address linked to www.addfriend.kr, associated with Lazarus infrastructure31[.]57[.]201[.]126- IP address hosting ketanovlaza.click C2 domain147[.]93[.]153[.]119- IP address hosting aptabase.khwdji319.xyz, part of Lazarus-linked infrastructure207[.]90[.]195[.]25- IP address hosting timeserver.uasecurity.org C2 infrastructure165[.]194[.]123[.]67- IP address linked to Lazarus/ta430 activity per TI Lookup
- Domains:
file[.]cdngoogleapis[.]com- Domain observed in Lazarus-linked infrastructure connections in threat intelligence datawww[.]addfriend[.]kr- Domain hosting a malicious index.html payload staging pageaptabase[.]khwdji319[.]xyz- Domain used as part of Lazarus-linked C2/telemetry infrastructuretimeserver[.]uasecurity[.]org- Domain used as part of Lazarus-linked C2 infrastructure
- Urls:
hxxp://www[.]addfriend[.]kr/board/userfiles/temp/index.html- Staging page hosting malware delivery contenthxxps://ketanovlaza[.]click/get_auto_reply_settings- C2 endpoint for retrieving bot auto-reply configurationhxxps://ketanovlaza[.]click/ping- C2 heartbeat/check-in endpointhxxps://ketanovlaza[.]click/get_commands- C2 endpoint used to retrieve commands for the implanthxxps://ketanovlaza[.]click/check_version- C2 endpoint used to check malware/component versionhxxps://ketanovlaza[.]click/get_webview_url- C2 endpoint used to retrieve a webview URL for further payload staginghxxps://ketanovlaza[.]click/send_admin- C2 endpoint used to send administrative data or exfiltrated informationhxxps://login[.]live[.]com/ppsecure/deviceaddcredential.srf- URL observed in threat intelligence data linked to credential-related phishing/malicious activity associated with Lazarus infrastructure
- File Paths:
newbeaver.py- Malicious Python script delivered to a target system during a fake technical assessment, functioning as a backdoor that beacons to attacker C2
- Other:
0xA3D6938f152C47A411263573Bb3AF324C25A8eba- Ethereum wallet address associated with DPRK IT worker fund routing0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0- Ethereum wallet address associated with DPRK IT worker fund routingjfullstackdev/jfullstackdev- GitHub repository used to receive unsolicited recruitment pitches from a DPRK-linked operative accountstackpilot108- GitHub account used by an operative to solicit collaborators via repository discussions
Showing defanged values
- domainaptabase[.]khwdji319[.]xyzDomain used as part of Lazarus-linked C2/telemetry infrastructure
- domainfile[.]cdngoogleapis[.]comDomain observed in Lazarus-linked infrastructure connections in threat intelligence data
- domainketanovlaza[.]clickC2 domain hosting multiple malware command and configuration endpoints (auto_reply_settings, ping, get_commands, check_version, get_webview_url, send_admin)
- domaintimeserver[.]uasecurity[.]orgDomain used as part of Lazarus-linked C2 infrastructure
- domainwww[.]addfriend[.]krDomain hosting a malicious index.html payload staging page
- filenamenewbeaver.pyMalicious Python script delivered to a target system during a fake technical assessment, functioning as a backdoor that beacons to attacker C2
- ip104[.]250[.]148[.]58AstrillVPN exit node used by operatives to spoof US network location
- ip107[.]150[.]38[.]250AstrillVPN exit node used by operatives to spoof US network location
- ip147[.]93[.]153[.]119IP address hosting aptabase.khwdji319.xyz, part of Lazarus-linked infrastructure
- ip165[.]194[.]123[.]67IP address linked to Lazarus/ta430 activity per TI Lookup
- ip173[.]211[.]106[.]101C2 server used by newbeaver.py malware sample on port 1245
- ip185[.]152[.]67[.]39DPRK-operated VPS used in IT worker infiltration infrastructure
- ip192[.]178[.]24[.]164IP address observed communicating over port 443, linked to Lazarus/uasecurity infrastructure per TI Lookup
- ip192[.]200[.]115[.]226AstrillVPN exit node used by operatives to spoof US network location
- ip199[.]168[.]112[.]175AstrillVPN exit node used by operatives to spoof US network location
- ip206[.]217[.]134[.]34AstrillVPN exit node used by operatives to spoof US network location
- ip207[.]90[.]195[.]25IP address hosting timeserver.uasecurity.org C2 infrastructure
- ip211[.]239[.]117[.]117IP address linked to www.addfriend.kr, associated with Lazarus infrastructure
- ip31[.]57[.]201[.]126IP address hosting ketanovlaza.click C2 domain
- ip45[.]77[.]71[.]42DPRK-operated VPS used in IT worker infiltration infrastructure
- ip89[.]187[.]185[.]11DPRK-operated VPS used in IT worker infiltration infrastructure
- md58c41b67b40ffd73b2c3d290c2e000383Hash of newbeaver.py, a malicious Python script delivered during a candidate technical assessment that beacons to a C2 server
- sha25655ef4a91183d06af8d29e59ad37e2489ed01eb19f5552f278b64b7156f752dc3Executable hash associated with Lazarus-linked infrastructure and phishing/C2 activity
- sha256c296a7ba8645ef6c06162228ca58618dcdc6f1205aec5680a7f355a53d2a0148Executable hash linked to Lazarus/andariel activity identified via threat intelligence cross-referencing
- urlhxxp://147[.]124[.]214[.]129:1244/keysC2 endpoint contacted by the newbeaver.py sample to exfiltrate key/system data
- urlhxxps://ketanovlaza[.]click/check_versionC2 endpoint used to check malware/component version
- urlhxxps://ketanovlaza[.]click/get_auto_reply_settingsC2 endpoint for retrieving bot auto-reply configuration
- urlhxxps://ketanovlaza[.]click/get_commandsC2 endpoint used to retrieve commands for the implant
- urlhxxps://ketanovlaza[.]click/get_webview_urlC2 endpoint used to retrieve a webview URL for further payload staging
- urlhxxps://ketanovlaza[.]click/pingC2 heartbeat/check-in endpoint
- urlhxxps://ketanovlaza[.]click/send_adminC2 endpoint used to send administrative data or exfiltrated information
- urlhxxps://login[.]live[.]com/ppsecure/deviceaddcredential[.]srfURL observed in threat intelligence data linked to credential-related phishing/malicious activity associated with Lazarus infrastructure
- urlhxxp://www[.]addfriend[.]kr/board/userfiles/temp/index[.]htmlStaging page hosting malware delivery content
