[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvuobwaEXYSCk4JVVN1hOouNp20qI2QqZ1zYkSGTCwD0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"16e7c74f-bbb0-4067-966d-3d67c7631f70","Huntress Uncovers Five Cases of North Korean Operatives Posing as Remote IT, Sales and Healthcare Workers","huntress-uncovers-five-cases-of-north-korean-operatives-posing-as-remote-it-sale-6e0f65","Cybersecurity firm Huntress has confirmed five separate incidents this year in which suspected North Korean operatives were successfully hired into legitimate organisations under false identities, in a wave of activity researchers say shows how the country’s so-called “remote IT worker” scheme has expanded well beyond IT roles. The cases, disclosed in a new advisory, involved […] The post Huntress Uncovers Five Cases of North Korean Operatives Posing as Remote IT, Sales and Healthcare Workers appeared first on IT Security Guru.","Cybersecurity firm Huntress disclosed five confirmed incidents in which suspected North Korean operatives successfully infiltrated legitimate organizations using false identities and posing as remote workers. The cases reveal expansion of North Korea's remote worker scheme beyond IT roles into sales and healthcare positions. The campaign demonstrates sophisticated social engineering and identity fraud tactics used by state-sponsored actors to gain access to corporate networks.","Huntress reports five North Korean operatives hired as remote IT, sales, and healthcare workers in 2024.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F08\u002F26\u002Fhuntress-uncovers-five-cases-of-north-korean-operatives-posing-as-remote-it-sales-and-healthcare-workers\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-uncovers-five-cases-of-north-korean-operatives-posing-as-remote-it-sales-and-healthcare-workers",null,"2026-08-26T13:35:45+00:00","2026-08-26T14:00:22.620486+00:00",8,[17,20,23],{"name":18,"type":19},"Huntress","vendor",{"name":21,"type":22},"North Korea","threat_actor",{"name":24,"type":25},"North Korean Remote IT Worker Scheme","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":12,"name":28,"slug":29},"Nation-state","nation-state",[31,36,41],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":12,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":49,"vendors":131},[50,79,105],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":80,"name":81,"problem":82,"products":83},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[84,89,97],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":85,"product_name":86,"url":87,"description":88},"entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":18,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":106,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":128,"url":129,"description":130},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[132],{"slug":111,"name":18,"logo_path":112,"roles":133},[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":151},"north-korean-operatives-infiltrate-companies-as-fake-remote-workers","North Korean Operatives Infiltrate Companies as Fake Remote Workers","North Korean state-sponsored actors successfully posed as legitimate remote employees across IT, sales, and healthcare roles, bypassing hiring controls through sophisticated identity fraud and social engineering. This campaign reveals that traditional background checks and onboarding processes are insufficient against well-resourced nation-state actors capable of fabricating convincing professional identities. Once embedded inside organizations, these operatives gained direct access to corporate networks, sensitive systems, and potentially classified or regulated data. The expansion beyond IT roles into sales and healthcare demonstrates that no department is off-limits, making organization-wide vigilance essential. This is not just a cybersecurity failure — it is a human vetting and process failure with serious national security implications.",[140,141,142,143,144,145,146,147,148,149,150],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-12: Identity Proofing","NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-53 SI-4: System Monitoring","NIST Insider Threat Guide (SP 800-53 IR-6)","GDPR Article 32: Security of Processing (for healthcare data exposure)","HIPAA §164.308(a)(3): Workforce Security","ITIL Service Transition: Identity and Access Management",{}]