A company was hacked after hiring a North Korean cyber criminal who posed as an IT contractor. The unnamed firm fell victim to a new hacking strategy from North Korea, as reported by the cybersecurity company Secureworks, which investigated the incident. The cyber criminal was contracted for a fixed term by the firm, which is located in the UK, US, or Australia; Secureworks has kept the exact location vague to protect the company.
According to Rafe Pilling, Secureworks’ director of threat intelligence, the criminal accessed and exfiltrated company data within days of starting the job. After the contract ended, the hacker used the stolen data to demand a significant ransom in exchange for not publishing it.
This tactic represents a new approach for the North Korean regime, which has been attempting to infiltrate UK companies with workers posing as freelance IT contractors. An advisory note from the government’s Office of Financial Sanctions Implementation (OFSI) indicated that UK firms are likely being targeted by these disguised North Korean IT workers to generate revenue for the regime. Hiring such workers could lead to violations of the “significant” sanctions currently imposed on North Korea, according to OFSI.
