How US Firms Track North Korean IT Threats
North Korea's Cyber Intrusions Targeting U.S. Tech Companies
North Korea’s cyber intrusions targeting U.S. tech companies are becoming increasingly bold and sophisticated. A major Silicon Valley-based law firm, Wilson Sonsini, issued a global warning to businesses on the 7th. Major U.S. tech firms like Apple, Google, and Amazon are struggling with North Korea’s refined remote job application attempts. The firm advised that companies ask detailed, off-script questions about applicants’ stated residences, education, and career backgrounds that are difficult to answer from a script, such as inquiring about local landmarks, current weather, or former colleagues.
North Korea is mobilizing national resources for disguised employment to fund its nuclear and missile programs. According to Wilson Sonsini, North Korean-linked groups are no longer limited to simple hacking but are targeting companies’ recruitment, HR, security, and financial systems. Key tactics include identity forgery using AI and deepfakes, exploitation of remote work structures, operation of “laptop farms” through U.S.-based accomplices, internal data theft, and money laundering through virtual currency.
The firm noted that AI advancements have made creating fake identities easier. In some cases, individuals posing as legitimate employees worked for months, gained internal access, and exfiltrated critical data like source code, databases, and cloud-stored materials. Such incidents could lead to violations of sanctions against North Korea, the firm warned.
Recommended Security Measures
Wilson Sonsini recommended strengthening visual identity verification during video interviews, rigorously verifying equipment delivery and login locations, and asking unscripted questions about applicants’ stated credentials. For example, asking about local landmarks, current weather, or former colleagues. Recently, a clip went viral on X showing a suspected North Korean IT infiltrator visibly flustered when asked to insult Kim Jong-un during a job interview — and then abruptly cutting the connection—a moment that became a viral meme. A source from a cybersecurity company called it “humorous but surprisingly effective.”
The firm also urged stricter internal security controls, including applying the principle of least privilege, monitoring remote management programs, detecting abnormal logins, and restricting external storage devices. It advised limiting virtual currency use in payroll processes and regularly checking for financial transaction violations linked to sanctioned countries.
Government Response and Concerns
The State Department stated on the 8th, “North Korea has increasingly relied on cybercrime in recent years to circumvent international sanctions and fund its illicit WMD and ballistic missile programs. Virtual currency theft and money laundering have become central to its strategy. In line with President Donald Trump’s pledge to protect Americans from fraud, we are countering malicious cyber activities and continuously innovating ways to defend U.S. citizens from North Korea’s numerous crimes.”
Additional Information
For those interested in accessing more content, there are various membership options available. One option offers a monthly subscription at 5900 won, with a discounted rate of 2900 won for newspaper readers. Another membership provides access to 8 different newspapers and magazines worth up to 55000 won. Additionally, members can receive 7000 points that can be used like cash for shopping.
