From Application to Access: �Detecting DPRK IT Workers Before They Become Insider Threats

Jesse Buonanno

whoami

• Staff CTI Sec Eng @ Snowflake
• Threat-Informed Defense Shill
• Spent a few years in the blockchain space following DPRK Threat Actors
• First time at BSides Seattle :D
• https://securitydozo.com if you want to reach out

** Opinions expressed are my own and systems discussed do not necessarily reflect Snowflake infrastructure

The Threat | DPRK IT Workers

What the Industry is Seeing

• Global targeting of remote roles across industries¹

�Impact to Organizations

• Shift to ransomware and extortion when caught
• IP theft to technologically enrich the regime
• Customer data theft for further exploitation

5 individuals aided DPRK Workers in targeting 136 U.S. companies, generating more than $2.2 million in revenue for the DPRK regime, and compromised the identities of more than 18 U.S. persons²

[1] https://www.okta.com/blog/threat-intelligence/north-korea-s-it-workers-expand-beyond-us-big-tech/�[2] https://www.justice.gov/opa/pr/justice-department-announces-nationwide-actions-combat-illicit-north-korean-government

Partnering with Recruiting | Building Alliances

How security is going to help make their lives better!

• Save them time by filtering out fraudulent candidates as they apply
• Prevent honest mistakes - No one wants to be the one who hired the threat actor

Establish joint accountability - Owning the risk without input controls causes friction

Applicant Tracking System(ATS) Integrations (Pull & Push)

🚩 Red Flag Education

• Refusal to go on camera
• Significant delayed responses
• Call center type environment - Lots of background voices
• Absolute aversion to any on-site requests

Source: https://undraw.co/search/Interview

The Hiring Lifecycle & Threat Modeling

(Out of Scope)

The Hiring Lifecycle & Threat Modeling | Cont.

Pre-Onboarding, The DPRK IT Worker Threat is A Killchain Problem

​

​

Interviews

Offer

Application

Preventative Controls (Active)

Composite Detections (Passive)

Threat-Informed Defense

Preventative Controls | Visual Continuity

Is it the same person seen in each interview? �Are they also the same person on government identification?

Recruiter/Hiring Manager Screen

Technical Interviews

Offer

Peer Interviews

https://medium.com/coinmonks/suspicious-activity-in-github-associated-with-lazarus-group-200868dff910

Preventative Controls | Identity Verification(IDV)

Source: https://developers.innovatrics.com/digital-onboarding/docs/use-cases/onboarding/

Preventative Controls | Identity Verification(IDV) Cont.

Is it the same person seen in each interview? �Are they also the same person on government identification?

​

​

Offer

Interviews

The FBI also recommends this → https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-worker-threats-to-u-s-businesses

Ask for Selfie and ID

Verify new information against initial baseline

SOP for interviewers to visually check candidate against the selfie

Preventative Controls | Response

Gov ID name doesn’t match name on resume?

** Programmatically notify assigned recruiter and hiring manager for final review **

Different person on interview than took selfie?

Gov ID Found to be digitally altered?

Virtual camera and Visual Filter used during selfie?

Preventative Controls (Active)

Composite Detections (Passive)

Threat-Informed Defense

Composite Detections | Overview

Collect – Telemetry from everything they touch

Enrich – Threat Intelligence Collections

Detect – Join the data and look for TTPs

Respond

1. Tag/Label Fraudulent Candidate(s)
2. Notify the hiring manager and/or recruiter

Application

Top of Funnel / First Touch Focus

Composite Detections | Collect

Hiring Lifecycle Telemetry Sources

• ATS Logs for submitted application(s)
• IPs, Resume, Socials, email, phone number, etc
• Video Conferencing Logs
• Email, IP
• Collaborative Coding Environments
• IP, Deception Heuristics
• Electronic Signature Logs
• IP, Browser Fingerprinting

The more logs you collect the greater chance�you’ll have at catching OPSEC slip-ups

Level of effort & complexity trade off for greater detection fidelity

Composite Detections | Enrich

• IP Intelligence
• GeoLocation, VPNs, Tunneled Traffic, Residential Proxies, Cloud Hosting, etc
• Socials Media Profile Fingerprinting
• LinkedIn¹ – Barren account activity across connections, posts, and general activity
• GitHub² – Forged commit dates, name and contact info changes, skill word salad
• Many CTI vendors are offering feeds of identified DPRK IT Workers (Full Persona Dumps)
• Infostealers have broken quite a bit of their OPSEC
• US Gov Public/Private Partnerships - DIB Cybersecurity Services³ provided by the NSA
• Research has shown a strong correlation to True Negative candidates having emails tied to “everyday” services. E.g. A life outside of work⁴

[1] https://nisos.com/research/dprk-github-employment-fraud/

[2] https://www.okta.com/blog/threat-intelligence/the-north-korean-on-your-payroll

[3] https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/DIB-Cybersecurity-Services/�[4] https://hiretofu.com/blog/the-humanness-signal-why-it-might-be-one-of-the-best-indicator-in-resume-fraud-detection

Composite Detections | Big ol’ List of Detections

​

IP Address

• Astrill VPN
• Residential Proxy
• High Risk Country
• Cloud Hosting
• Bulletproof Hosting

Phone Numbers

• VOIP Number
• High fraud and spam scores
• A few Providers Abused…
• Onvoy
• Level 3
• Telnyx

Email Address

• “First Seen” / Fresh
• In data breaches (True Neg)
• Suspicious Pattern
• `fname.lname.dev###@gmail.com`
• Match against DPRK Threat Feeds
• High fraud and spam score

Socials

• Github Fingerprinting
• LinkedIn Fingerprinting

Resume Analysis

• Metadata Analysis
• Resume differs from info on socials

Anomaly Detection

• Same email tied to >= 2 sufficiently different names
• One phone number shared between >=3 candidates
• Semantic name dedupe via LLM
• High deception in technical interview

HUMINT

1. Recruiter finds 🚩
2. Labels/Tags in ATS
3. Webhook picks up the tag
4. Backpropagate all of that candidate’s telemetry for matches against other candidates (OPSEC slip-ups)

Composite Detections | Example Detector Scoring

+1 Known suspicious email pattern�+2 VOIP Phone number with high fraud score�+5 Same email used on >1 profiles with sufficiently different names�-5 Email found in Drizzly, AT&T, and Adobe breaches�+3 IP associated with known residential proxy�+5 Github attributed to DPRK campaign by DPRK Threat Feed�+1 LinkedIn social graph and activity shows no activity and odd connections�+1 Email never before seen by fraud provider

Composite Detections | Meet Bryant Dang

​

Composite Detections | Meet Bryant Dang cont.

​

❌ 16 Score well above threshold to auto-reject�

Composite Detections | Response

1. Hit ATS API to see if candidate has been hired
• If yes - Notify IR or Insider Threat Team to kickoff investigation playbook
2. Label/Tag candidate profile in ATS system
3. 🤞ATS has platform native way to add plain language notes to the candidate profile detailing the suspicious behavior detected
4. Notify assigned recruiter and/or hiring manager
5. Rejection - Personalize to your needs and where in the life cycle you are
• Auto Reject - *Optional* based on risk tolerance and severity confidence
• Have SOP for risk owner to make human in the loop final decision
1. This is going to be difficult at scale
• Store telemetry from candidate for future detections

End Suite of Mitigating Controls

Vendors Operating in the Space – Do your own Due Diligence

Top of Funnel Detections

Specialized in Fraud Detection

• Tofu
• Endorsed

Native ATS Controls

• Greenhouse – Real Talent^TM
• ^{CLEAR Backend}
• Ashby – Fraud Detection
• Lever – Candidate Insights

Identity Verification

• FirstAdvantage
• ID.me backend
• CLEAR
• WithPersona
• Incode
• …

* Some integrate with your ATS

Link to the Deck

Also on https://securitydozo.com