[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-DxVieEhZ3LChfvOsE7Ly5GjQZI7029l7Mr7LypJ51c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"ef5ee104-7aa5-4bd3-838e-f810ae7c6a4a","north-korean-fake-it-workers-reached-onboarding-and-accessed-sensitive-employee-data","50997883-63f1-44a5-a8c0-75363c638c34","North Korean Fake IT Workers Reached Onboarding and Accessed Sensitive Employee Data","Over a one-year period, 27 suspected North Korean personas successfully navigated the hiring process to reach the onboarding stage at real companies, with one gaining access to approximately 277,000 files containing Social Security numbers. The core failure was treating a newly hired remote employee as an immediately trusted insider without validating their true identity or limiting their initial access to only what was necessary for their role. Files containing sensitive PII should never be shared company-wide or via open public links, as this dramatically amplifies the damage any malicious insider—fake or otherwise—can cause. This incident highlights that the hiring pipeline itself is an attack surface, and that identity verification, least-privilege access provisioning, and data governance must be treated as security controls, not HR formalities.","**Immediate actions:**\n- Audit and revoke all overly broad file shares (company-wide or public link access) containing PII such as Social Security numbers.\n- Implement a 30-day restricted access period for all new remote hires, granting only the minimum permissions needed to begin work.\n\n**Identity verification measures:**\n- Require live video identity verification against government-issued ID during the hiring process, especially for fully remote engineering roles.\n- Cross-reference candidate identities using multiple independent signals (e.g., LinkedIn history, tax documents, background check providers) before extending offers.\n- Establish escalation procedures when candidates resist or repeatedly reschedule video verification steps.\n\n**Long-term improvements:**\n- Classify and label all files containing PII and enforce access controls so they can never be shared via open or company-wide links.\n- Integrate data loss prevention (DLP) tooling to alert on bulk access to sensitive files by newly provisioned accounts.\n- Develop a formal insider threat program that includes behavioral monitoring for anomalous data access patterns in the first 90 days of employment.",[12,13,14,15,16],"NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-53 AC-6: Least Privilege","CIS Control 3: Data Protection","NIS2 Article 21(2)(i)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(i)":18,"CIS Control 3: Data Protection":19,"MITRE ATT&CK T1078: Valid Accounts":20,"NIST SP 800-53 AC-6: Least Privilege":21,"NIST SP 800-53 PS-3: Personnel Screening":22},"This point covers human resources security and access control, directly requiring that personnel vetting and access provisioning processes are designed to prevent unauthorized or malicious actors from gaining trusted system access.","CIS Control 3 requires organizations to inventory, classify, and restrict access to sensitive data, which would have prevented Social Security number files from being accessible via open company-wide or public links.","The North Korean personas exploited legitimately provisioned employee accounts to gain trusted insider access, which is the core technique T1078 describes.","AC-6 mandates that users are granted only the access required for their role, which would have prevented a new hire from reaching 277,000 sensitive files on day one.","PS-3 requires organizations to screen individuals prior to authorizing access to systems, which would have flagged the fabricated identities before onboarding was completed.","published","2026-11-13T08:22:51.030208+00:00","2026-11-13T08:22:51.018+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fnorth-korean-it-workers-onboarding\u002F","suspected-north-korean-it-workers-reached-onboarding-at-companies-with-open-data-71c043","Suspected North Korean IT workers reached onboarding at companies with open data",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":60,"name":61,"problem":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]