[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpaO9Yw--WGF9zNX6c8nXZvuBDpKYHYlddI7QU1lRKpI":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"898737eb-cd02-4847-ae77-3270a05b8e51","Defense contractor pleads guilty to aiding North Korean remote worker scheme","defense-contractor-pleads-guilty-to-aiding-north-korean-remote-worker-scheme-a7b354","The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.","A defense contractor with top secret clearance has pleaded guilty to aiding North Korea's remote worker scheme. He allowed co-conspirators to use his identity and clearance for nearly 100 job applications, securing nine offers. The scheme aimed to place North Korean operatives in sensitive roles, with one individual working on a military AI project before being terminated.","Defense contractor pleads guilty to aiding North Korea's remote worker scheme.","https:\u002F\u002Fcyberscoop.com\u002Fdefense-contractor-guilty-north-korea-scheme-facilitator\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2020\u002F11\u002Fpyongyang-getty.jpg","2026-10-30T15:14:29+00:00","2026-10-30T16:00:12.411548+00:00",8,[17,20],{"name":18,"type":19},"North Korea","threat_actor",{"name":21,"type":22},"DTEX","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":44,"vendors":118},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":75,"name":76,"problem":77,"products":78},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[79,87,92],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":88,"product_name":89,"url":90,"description":91},"entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[105,113],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":114,"product_name":115,"url":116,"description":117},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":131},"defense-contractor-enables-north-korean-operatives-to-infiltrate-sensitive-roles","Defense Contractor Enables North Korean Operatives to Infiltrate Sensitive Roles","A cleared defense contractor deliberately lent his identity and top-secret clearance to co-conspirators, allowing North Korean operatives to apply for and obtain sensitive positions, including one involving a military AI project. The root failure was a breakdown in identity verification and insider threat controls that allowed a trusted insider to weaponize his own credentials for adversarial purposes. This matters because cleared personnel accessing classified or sensitive programs represent a privileged attack surface that, once compromised from within, can expose national security assets and proprietary technology. Supply chain and hiring processes lacked sufficient controls to detect fraudulent identity reuse across nearly 100 job applications, suggesting systemic gaps in background verification continuity.",[124,125,126,127,128,129,130],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":132,"MITRE ATT&CK T1566: Phishing":133,"NIST SP 800-53 SI-2: Flaw Remediation":134,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":135,"CIS Control 17: Incident Response Management":136,"CIS Control 14: Security Awareness and Skills Training":137,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":138},"NIS2 requires incident handling and supply chain security measures for entities handling sensitive operations; mandatory supply chain due diligence under this article would require verifying contractor and vendor identities rigorously before granting access.","The broader DPRK remote worker campaign relies on social engineering and identity deception tactics analogous to phishing to infiltrate organizations; controls targeting deceptive identity presentation would address this attack pattern.","While primarily about patching, SI-2's broader mandate to identify and correct systemic weaknesses applies here to the procedural flaw in continuous personnel vetting that allowed the scheme to persist undetected.","This clause requires organizations to ensure personnel in sensitive roles are who they claim to be and are competent and trustworthy; formalized competence and identity verification processes would have surfaced the fraudulent placements.","The North Korean operative worked on a military AI project before being terminated, indicating a delayed detection and response; a mature incident response plan with insider-threat playbooks would have shortened the window of exposure significantly.","Hiring managers, HR staff, and contracting officers lacked sufficient training to recognize red flags of identity fraud and insider-threat behaviors that were present across nearly 100 suspicious applications.","This function requires organizations to manage identities and verify who is accessing sensitive systems; stronger identity proofing under PR.AA would have detected that a single cleared identity was being fraudulently reused across dozens of applications."]