Here is a self-check list to avoid pitfalls in recruitment.

Written by: Wenser (@wenser 2010), Planet Daily

Like security companies that actively engage in phishing enforcement, North Korean hackers are also upgrading their "attack methods," evolving from initial technical vulnerabilities to social engineering attacks, and later to involvement in outsourced projects and remote onboarding for encrypted projects. Recently, they have introduced a new tactic for infiltration: first hiring someone to interview through an encryption company, then taking that person's place to enter the company, lurking until the right moment to strike, ultimately stealing encrypted assets and sensitive information through internal technical attacks.

After a month, the war between security companies and North Korean hackers has progressed anew, and a new type of scam has surfaced.

"Curved Rescue of the Nation": Hackers Hire People for Interviews and Then Take Over Positions, Ultimately to "Serve the Motherland"

First, let's understand the "achievements" of North Korean hackers: data from the security company CrowdStrike shows that in 2025, losses due to North Korean state-linked hackers and threat actors in cryptocurrency exceeded $2 billion, a year-on-year increase of 51%; the Bank of Korea estimates that despite facing coordinated global sanctions, North Korea's GDP growth rate in 2025 still reached 3.5%.

Currently, it is clear that North Korean hackers, as part of the "national team," have made an important contribution to the country's economic growth.

On July 31 of this year, the United States Department of State and the FBI, in conjunction with Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand, and the UK, produced a security report titled "Alert on North Korean IT Workers."

The report is packed with information, key contents include the following:

First, North Korea relies on a network of tech developers deployed both domestically and internationally to conduct operations abroad, sending these technicians to acquire false identities, work remotely for profit, and ultimately transfer their earnings back to North Korean government accounts. The funds eventually contribute to the development and advancement of North Korea's nuclear and ballistic missile programs.

Secondly, looking at the specific job content of North Korean hackers, these tech developers typically obtain work and corresponding salary income through impersonating citizens of other countries on online employment, procurement, and contracting platforms operated by private companies abroad.

Furthermore, in addition to earning regular employee salaries, North Korean tech service personnel pose extremely high internal threats to the business information and assets of the companies they join. A significant number of them take this opportunity to engage in data theft, cryptocurrency theft, and theft of sensitive information.

Finally, in terms of specific implementation methods, the preparations and operations of North Korean hackers are becoming increasingly complex, even including the use of AI models and applications to create fake identities and conduct illegal activities globally.

It is worth mentioning that the most important information noted in this report is that based on previous "in-person interviews," North Korean hackers have recently upgraded their "work processes"—

• Now, they often recruit some technical staff from third countries (such as Iran and Lebanon) in advance through job platforms like LinkedIn;
• Then, North Korean hackers request some tech developers to work part-time as "interview assistants," paying them $500 in cryptocurrency each month to assist with onboarding into the target company.
• Lastly, the North Korean hackers take over the positions themselves, entering the target company as part of the team, achieving technical infiltration, while earning corresponding salary rewards and looking for opportunities to steal sensitive information, data, cryptocurrency assets, and technologies.

Undoubtedly, in the ongoing arms race of cybersecurity, North Korean hackers are also gradually upgrading their "SOP (Standard Operating Procedures)," and their ultimate goal, of course, is to transfer the funds back to their home country.

Self-Checking List for North Korean Hacker Infiltration: From Employee Personal Information to Daily Expression Habits

Currently, the methods used by North Korean hackers are difficult to defend against, but they still have traceable patterns. Here are some warning signals that companies should be vigilant about and self-check:

For companies operating online platforms, it is crucial to pay attention to the following aspects:

• Employees frequently change registration information (account names, contact information, receiving bank account, etc.).
• Names on employee identification documents do not match those on registered payment accounts.
• Multiple payment accounts created using the same identity documents.
• Identity verification documents appear forged or generated/altered by image editing software or AI image generation tools.
• Multiple technical accounts making access requests from the same IP address.
• A single account making access requests from multiple IP addresses in a short time.
• Accounts remaining logged in for abnormally long periods.
• Accumulated work hours or related performance indicators are abnormal (such as excessive online time, unusually high work efficiency, or excessive workload).
• Users on recruitment sites writing false reviews for themselves to enhance their job rating.

For companies hiring employees or conducting interviews and outsourcing, paying attention to the following details can help avoid internal infiltrations by North Korean hackers:

• Interviewees' personal profiles contain errors or unnatural expressions (suspected machine translation), claiming they are not proficient in the language of their identity information (given the prevalence of AI translation services, this should be scrutinized in their language expression).
• Exposing fabricated details during video conferences, such as mismatched photos and identity information; the video feed appears to be AI-generated or coordinated with third parties, with unnatural language expressions and body language.
• Interview employees refusing to participate in video conferencing or show their faces.
• Labor compensation offers lower than general market prices.
• Showing that their personal technical accounts are operated by multiple people (usually indicating that such hacking activities often operate in teams with real interactions possibly changing over time).
• Requesting payment in cryptocurrency for corresponding rewards, refusing to provide complete bank account and payment account information.