North Korean IT Workers Targeting European Companies to Compromise Corporate Systems
North Korean IT workers have broadened their scope beyond the United States, increasingly targeting European organizations.
These cyber operatives masquerade as legitimate remote employees to infiltrate companies, generating revenue for the DPRK regime and potentially compromising sensitive corporate infrastructure.
Their tactics now include:
Falsifying credentials
Building rapport with recruiters
Using multiple personas to endorse their fabricated identities on job platforms like Upwork and Telegram.
The infiltration process begins when these operatives apply for remote technical positions, especially in the defense industrial base and government sectors. They create detailed backstories, claiming nationalities from various countries such as Italy, Japan, Malaysia, Singapore, and Ukraine.
Google Threat Intelligence Group (GTIG) Findings
GTIG has uncovered this growing threat through extensive investigations in collaboration with security partners. Their research reveals a tactical shift due to increased awareness and enforcement actions in the United States, prompting these operatives to establish more robust operations across Europe.
Impact and Escalation
The impact of these infiltrations goes beyond simple fraud, with recent incidents showing a rise in extortion attempts against former employers. When discovered and terminated, these IT workers have threatened to release sensitive data or sell proprietary source code to competitors, marking a significant escalation in their tactics. This shift coincides with heightened law enforcement actions, suggesting that pressure is driving them toward more aggressive revenue-generation strategies.
Technical Expertise
Technical projects undertaken by these operatives demonstrate considerable expertise, ranging from traditional web development to advanced blockchain and AI applications. Their work includes development using:
Next.js
React
CosmosSDK
Golang
Blockchain technologies such as Solana and Anchor/Rust smart contracts.
Exploitation of Virtualized Infrastructure
A particularly concerning development is the DPRK IT workers’ focus on bring your own device (BYOD) environments starting in January 2025. These settings allow employees to access company systems through virtual machines on personal devices, creating significant security blind spots.
Unlike corporate laptops that contain monitoring software, personal devices operating under BYOD policies typically lack traditional security and logging tools, making their activities substantially harder to track. This environment eliminates conventional evidence trails such as corporate laptop shipping addresses and endpoint software inventories. Without these detection mechanisms, the IT workers can operate with minimal risk of discovery while accessing sensitive corporate resources.
Security analysts note that this approach represents a strategic evolution, as the operatives have identified these virtualized environments as particularly vulnerable to their infiltration schemes.
Original source: https://cybersecuritynews.com/north-korean-it-workers-attacking-european-organizations/
