Material Security counted 27 North Korean IT worker personas that reached corporate onboarding

Over one year, Material Security counted 27 fabricated North Korean IT worker personas that made it through corporate hiring pipelines to onboarding.

Material Security said 2,429 fabricated personas made contact over the year, and 1,100 advanced to an interview or beyond. And 27 reached onboarding, which works out to about one successful persona per 90. The researchers defined onboarding as the stage involving offer letters and background checks as well as equipment requests and first-day IT setup. The funnel ran from contact to onboarding.

Each persona is a fabricated jobseeker built with a résumé and a face, and each applied for remote engineering roles, Material Security said. The firm said anyone among the 27 given credentials arrived trusted and provisioned but hostile from the start.

The firm found that 41% of the personas showed up at multiple organizations. Fifteen of them appeared at 10 or more organizations, and one appeared at 19. Among the 27 personas that reached onboarding, 18 were simultaneously pursuing opportunities at other organizations. One persona was completing onboarding paperwork at one company while seeking jobs at seven others at the same time.

Within the past 30 days, Material Security observed 232 suspected personas making contact with 99 organizations. At 42 of those organizations, at least one persona reached an interview or offer stage. Personas reached onboarding at four of the organizations, and Material Security reviewed sensitive files at those four companies.

Material Security said roughly 277,000 files containing Social Security numbers were shared across one company or through public links after a persona reached onboarding there in the past month. At that first company, roughly 15 million source-code files sat alongside 130,000 files containing bank or routing numbers that were barely shared beyond their owners.

At the second company, roughly 400,000 files held Social Security numbers alongside 345,000 files containing bank or routing numbers. 68 percent of the Social Security files and 71 percent of the bank files there could be reached by any company account or anyone holding a link. Someone starting there would have required only a login to reach those files. That reflects open sharing of sensitive files at the second company.

The third company stored roughly 14 million source-code files, with about 1,900 readable by anyone who had the URL. That marks source-code exposure at the third onboarding company. The smallest company kept roughly 1.5 million source-code files along with files holding private cryptographic keys. There, about 21% of financial files and 17% of credit-card files were shared beyond their owners.

CrowdStrike said its investigators see one or two suspected cases each day tied to North Korean IT workers. The FBI warned the scheme presents a serious insider threat involving national security and intellectual property theft. Workers targeted cleared defense contractors, positions requiring U.S. government security clearances, and active-duty military personnel able to host company laptops. Federal cases show that overseas workers gained access to sensitive U.S. military technology.

Prosecutors said that in January 2024 an overseas worker using a stolen American identity started remote software engineering work for a California defense contractor that developed AI-powered equipment and technologies. The computer went to a conspirator in New Jersey, then to a laptop farm where software let the overseas worker run it from afar. The worker remained inside the contractor’s systems for more than two months, downloading technical data that included material controlled under ITAR.

Within roughly six weeks, the same contractor brought on two additional overseas workers with stolen American identities, routing their laptops through U.S.-based facilitators. U.S.-based laptop farms made up a network that helped overseas workers win remote jobs at more than 100 American companies.

Last October, FBI agents searched more than 40 suspected laptop farms in Texas and seized 187 laptops and other devices. The Justice Department said those coordinated actions reached more than 70 American companies.

Prosecutors said conspirators took on the stolen identity of a Virginia man employed at a cleared defense contractor with an active top secret security clearance. One impostor received a $130,000 software engineering offer from a government contractor developing generative AI for a U.S. military component. A laptop went to the Virginia man’s home, but a video call showed the person on the call was not the identity holder.

In March 2024, CrowdStrike started tracking what it calls the Famous Chollima campaign after an apparent single malicious insider led to dozens of customer victims. CrowdStrike tied Famous Chollima to North Korea’s Munitions Industry Department and said the main goal is revenue to fund the weapons program. Treasury sanctioned another North Korean IT-worker network last week.

The Treasury said the regime keeps most of the workers’ pay and raises hundreds of millions of dollars for ballistic missiles and weapons of mass destruction.

Adam Meyers said operatives use AI to build convincing LinkedIn profiles and resumes, to answer interview questions, and to change their video appearance. Some operatives also use AI to perform the job after being hired, Meyers said.

The FBI said workers purchased access to identity-verification services and used them to test stolen identities. The FBI said workers paid Americans to appear on camera or finish employment requirements, and sometimes outsourced whole jobs to other foreign workers. Workers almost always take data from victim companies because many must record their screens to document daily work, the FBI said.

Adam Meyers said CrowdStrike located laptop farms by spotting patterns across cases and gave the FBI tips that led to searches and arrests of U.S.-based facilitators. “They’re an employee, so they have access to whatever an employee would have,” Meyers said. Meyers said identity verification should be handled as a security matter rather than just hiring, with recruiters and security teams trained to spot tactics.

Operatives from North Korea have posed as recruiters to target employees already working inside companies. Binance stated that a software engineer received contact through a real job platform from someone pretending to be an executive at a fictitious company. That is the fake-recruiter approach reported by Binance.

“In order to penetrate the network, phishing is one option or getting someone hired at Binance,” said Blockaid CEO Ido Ben-Natan. Binance initially pointed to an engineer’s laptop as the center of the $6.3 billion digital theft before adding that more breach points existed.

Fake recruiting campaigns such as ClickFake Interview deliver malware to job candidates through technical assessments and video calls. JFrog researchers uncovered AccuraSoftHire, a fake company that included a careers site, testimonials, a LinkedIn page, job listings, and verified recruiters. The decoy company was designed to trick candidates into running malware. Alina Krasavina said, “The first one sent a ‘technical assessment’: a Next.js project of 113 files.”

Binance said a fake job interview allowed attackers to compromise an engineer’s computer and reach systems used to approve cryptocurrency transfers. The FBI pinned the Binance theft on the TraderTraitor group. Jeremy Robertson said, “This is not something we can patch.”

Material Security recommends pairing hiring controls with access controls since a hired North Korean worker holds valid credentials. The firm recommends flagging personas early by connecting recruiting and onboarding signals to threat intelligence to block a fake identity before credentials are issued.

Material Security recommends checking identities closely since background checks can catch a fabricated persona. The firm says a watchlist hit during onboarding matters more than a hit at first contact, so teams should triage by stage. That is the triage-by-stage recommendation.

After onboarding, Material Security recommends continuing investigations by reviewing an account’s permissions, app grants, and activity once an account exists. The firm recommends mapping access in advance so responders can view the files, messages, credentials, and connected apps tied to each role.