FlagThis

North Korean IT workers are expanding their remote work scams into Europe following increased crackdowns in the United States. Google security researchers have identified a shift in focus towards European companies, with these North Korean operatives attempting to secure remote IT positions using fabricated identities and credentials. The workers are reportedly targeting organizations in Germany, Portugal, and the United Kingdom, and may use AI-generated profile photos to enhance their credibility during video interviews.

This expansion poses a growing cybersecurity threat to European businesses. The IT workers often claim to be based in other countries, connecting via laptop farms to fraudulently secure remote freelance IT positions. Once inside a company, they may engage in cyber espionage and data theft to generate revenue for the North Korean government, including its weapons development programs. Over the last 30 days, nearly 24,000 unique IP addresses have attempted to access European portals, potentially as a precursor to targeted exploitation, highlighting the scale and coordinated nature of this operation.

ImgSrc: thedefendopsdia

References :

• Risky Business Media: Risky Bulletin: North Korean IT worker scams expand to Europe
• PCMag UK security: As US Cracks Down, North Koreans Target Europe With Remote Work Scams
• The DefendOps Diaries: Explore the cybersecurity threat posed by North Korean IT workers infiltrating European companies using advanced tactics.
• BleepingComputer: ​North Korea's IT workers have expanded operations beyond the United States and are now increasingly targeting organizations across Europe.
• The Register - Security: North Korea’s fake tech workers now targeting European employers
• www.it-daily.net: Fake IT employee from North Korea had 12 identities
• : North Korea's Fake IT Worker Scheme Sets Sights on Europe
• www.itpro.com: Google warns that fake North Korean IT workers have expanded to Europe

Classification:

• HashTags: #Cybersecurity #NorthKorea #RemoteWorkScam
• Company: Google
• Target: European Companies
• Attacker: North Korean
• Product: Gmail
• Feature: recruitment
• Type: Hack
• Severity: Medium