North Korean Identity Laundering & IT Worker Scheme Disrupts 136 US Companies – 2024
Executive Summary
Between 2019 and 2024, a coordinated North Korean scheme enabled state-backed operatives to access U.S. company systems and launder stolen funds. Facilitated by both domestic and foreign conspirators, including Oleksandr Didenko, Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, and Erick Ntekereze Prince, the operation leveraged stolen and forged American identities to secure remote IT jobs, deploying laptop farms and remote access software to evade detection. The group collectively compromised over 136 U.S. companies, funneled more than $2.2 million to North Korea's regime, and participated in cryptocurrency heists attributed to APT38.
The case signals a pronounced jump in sophisticated, identity-driven attacks by nation-state threat actors targeting both the technology sector and U.S. critical infrastructure. As similar TTPs proliferate, the incident underscores the urgent need for robust identity verification, zero trust segmentation, and ongoing monitoring to counter evolving supply chain threats.
Why This Matters Now
Nation-state cyber threats are increasingly leveraging insider access, false identities, and remote working tools to infiltrate corporate environments at scale. The rapid exploitation of U.S. businesses for financial gain highlights critical gaps in identity management, supply chain due diligence, and monitoring of remote access, making this an urgent issue for organizations with distributed or outsourced workforces.
Attack Path Analysis
North Korean threat actors gained initial access to U.S. corporate resources through fraudulent identity procurement and infiltration of hiring processes, using remote access software on hosted laptops. Leveraging initial access, they circumvented security measures to escalate privileges within victim environments. The attackers then moved laterally within cloud or hybrid infrastructure, exploiting internal connectivity. Remote access tools established persistent command and control for continuous operations. Stolen data, including cryptocurrency and sensitive company information, was exfiltrated via outbound traffic. Ultimately, the adversary caused financial loss, identity compromise, and enabled monetary support for North Korea’s regime.
Kill Chain Progression
Initial Compromise
Description
Threat actors used purchased and stolen U.S. identities to pose as legitimate IT workers, gaining access to organizations through fraudulent remote onboarding and installation of authorized remote access tools.
Related CVEs
CVE-2024-7971
CVSS 9.8A zero-day vulnerability in Chromium allowing remote code execution, exploited by North Korean threat actors targeting the cryptocurrency sector.
Affected Products:
Google Chromium – < 116.0.5845.96
Exploit Status:
exploited in the wildCVE-2025-55182
CVSS 10A critical vulnerability in React Server Components allowing pre-authentication access, exploited by North Korean hackers to deploy malware.
Affected Products:
Meta React Server Components – 19.0, 19.1, 19.2.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Valid Accounts
Gather Victim Identity Information
Remote Services
Phishing
Email Collection
Stage Capabilities: Upload Malware
Proxy
Input Capture
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Unique Identification for Users
Control ID: 8.1.2
NYDFS 23 NYCRR 500 – Cybersecurity Program
Control ID: 500.02
DORA (Digital Operational Resilience Act) – Access Management and Identity Verification
Control ID: Art. 9(2)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Identity Verification and Access Control
Control ID: Identity Pillar
NIS2 Directive – User Access and Asset Management
Control ID: Article 21(2)d
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
North Korean operatives infiltrated IT companies using stolen identities and remote access, compromising segmentation controls and enabling lateral movement threats.
Computer Software/Engineering
Remote IT worker schemes directly targeted software companies, exploiting weak identity verification and enabling potential code tampering and data exfiltration.
Financial Services
APT38's $15M cryptocurrency theft demonstrates sophisticated egress security bypasses and threat detection evasion capabilities against financial institutions' encrypted traffic.
Banking/Mortgage
Cryptocurrency heists and identity theft operations pose direct threats to banking infrastructure, requiring enhanced anomaly detection and zero trust controls.
Sources
- DOJ lauds series of gains against North Korean IT worker scheme, crypto theftshttps://cyberscoop.com/doj-north-korea-it-worker-scheme-cases-crypto-seized/Verified
- Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemeshttps://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remoteVerified
- Four North Koreans Charged in Nearly $1 Million Cryptocurrency Theft Schemehttps://www.justice.gov/usao-ndga/pr/four-north-koreans-charged-nearly-1-million-cryptocurrency-theft-schemeVerified
- North Korean threat actor Citrine Sleet exploiting Chromium zero-dayhttps://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, internal workload isolation, egress controls, and robust anomaly detection would have drastically limited unauthorized access, lateral movement, and data exfiltration throughout the attack. CNSF-aligned enforcement would detect suspicious remote access, restrict fraudulent privilege escalation, and block unauthorized outbound traffic.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection of unusual user onboarding or anomalous remote access tools.
Control: Zero Trust Segmentation
Mitigation: Limits unauthorized privilege escalation by enforcing identity-based least privilege.
Control: East-West Traffic Security
Mitigation: Blocks and logs lateral movement attempts across segmented environments.
Control: Cloud Firewall (ACF)
Mitigation: Restricts unauthorized outbound communications and flags anomalous remote sessions.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents unauthorized data exfiltration and alerts on unusual outbound patterns.
Comprehensive visibility reveals and limits fraud and asset abuse.
Impact at a Glance
Affected Business Functions
- Software Development
- Cryptocurrency Transactions
- Data Security
Estimated downtime: 14 days
Estimated loss: $2,200,000
Compromised identities of at least 18 U.S. residents; unauthorized access to sensitive employer information, including export-controlled U.S. military technology and virtual currency.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce identity-based access at user, workload, and application layers.
- • Deploy real-time anomaly and threat detection to identify fraudulent activity and unauthorized remote access.
- • Enforce strict egress filtering and policy-based controls on outbound data movement and application-to-internet traffic.
- • Harden internal east-west traffic using segmentation and microsegmentation to prevent illicit lateral movement.
- • Establish centralized, cloud-native visibility and logging for rapid detection, investigation, and incident response.
