Malicious North Korean actors attempt to infiltrate technology companies

TL;DR: DPRK laptop-farm developer infiltration via identity verification bypass

• A live campaign: Everyone treats North Korean tech infiltration as a KnowBe4 anecdote for the tabloids. It is a live campaign against every startup hiring a Senior full-stack engineer, and third-party identity verification passed the actors on the first pass.
• What cside saw: cside interviewed 3-4 near-identical Tommy Jackson candidates run from laptop farms, all passed a third-party ID check, and the pattern was later confirmed in Wired's investigation with Bobbie Johnson. Applicant fraud detection uses device fingerprinting to catch the underlying infrastructure before the interview call.
• Add device intelligence: If you are a solo founder or a startup recruiter and your ATS trusts an identity verification API blindly, add device intelligence before the take-home assessment stage. Otherwise you will keep burning hours screening laptop-farm resumes instead of real candidates.

Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.

Important note: the bad actor was not successful in gaining access to any cside systems. This blogpost is purely a warning to other startup founders and employers.

When hiring for a Senior full-stack engineer we got quite excited when we quickly received a couple of hundred resumes that looked promising.

I spent a few hours selecting relevant profiles and sent them an assessment through Coderbyte. From a number of candidates I received the homework task back quickly and the results were decent so we moved forward to an interview to discuss the code that was written.

When joining the call, a few things caught my attention.

1. The candidate in question had the most American made up sounding name. "Tommy Jackson" style.
2. The candidate had background noise similar to a call center.
3. The candidate's English was garbage and they showed clear ethnic characteristics of Korean nationality.
4. The candidate gave very scripted sounding answers to questions.

Having learnt about unconscious bias during recruiting I thought it was nothing but after having 3-4 near identical conversations, I got curious so I sent those candidates through Identity verification with a 3rd party service and was surprised to learn they passed.

So I checked with a fellow founder about what this was, and quickly learned that companies like KnowBe4 had hired these people and faced immediate, severe consequences.

You'd expect for North Korean attempts to infiltrate companies to be common knowledge, but that was not the case.

What we faced were organised and deeply professional attempts to infiltrate our business. Most run from laptop farms, using multiple devices under separate identities to flood job listings across companies simultaneously.

So I got in touch with a fellow ex-founder, Bobbie Johnson to dig a lot deeper into this operation and find a way to make this more common knowledge. Today, the full Wired article was released going into great detail on the local operations of the scam.

During the process of hiring, as a solo founder, I grew increasingly frustrated with the amount of time wasted on screening resumes to filter out North Korean actors.

Firstly, by asking our friend Feross at Socket if I could borrow his AnnoyingSite project to annoy the North Korean actors and incentivise them to apply elsewhere instead. Which we did and mildly amused me, check the "take home assessment" here. This didn't help though...

And then it clicked, I run a client-side security company. So naturally, I should use our client-side intelligence to figure out patterns to filter out this noise at the source. To improve applicant screening, we've began leveraging device fingerprinting as a way to proactively detect suspicious patterns tied to fraudulent job applicants.

So today, we are announcing our applicant fraud detection service to an early closed BETA. Our lightweight fraud detection software has a tailored prevention solution built specifically for applicant vetting.

This lets startup founders and recruiters dedicate their time to screening the resumes of legitimate candidates.