aviatrix logoAviatrix
Under Active Attack

Executive Summary

North Korean threat actors have significantly expanded their fraudulent employment scheme beyond the traditional IT sector, with confirmed infiltrations into healthcare, sales, and marketing roles across Fortune 500 companies and government agencies. The campaign, tracked as Famous Chollima, Jasper Sleet, and PurpleDelta, leverages AI-generated identities, stolen documents, and sophisticated deception techniques including real-time ChatGPT responses during interviews and KVM switches for remote device control. Recent investigations by Huntress and Recorded Future revealed workers using fabricated personas to apply to over 1,100 companies, generating millions in illicit revenue that funds North Korea's nuclear weapons program while creating unprecedented insider threats for organizations worldwide.

This expansion represents a critical evolution in state-sponsored infiltration tactics, as traditional cybersecurity defenses prove inadequate against legitimately hired employees who perform actual work while potentially accessing sensitive data and systems from within trusted network perimeters.

Why This Matters Now

The expansion beyond IT roles into healthcare and sales creates new attack vectors that bypass traditional security controls, while AI-enabled deception techniques are making these infiltrations increasingly difficult to detect during standard hiring processes.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Organizations should implement rigorous background checks, verify employment history, look for anomalies in identity documents, and be suspicious of candidates using personal devices or requesting unusual banking arrangements.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly constrained North Korean threat actors' ability to move laterally and exfiltrate data once gaining legitimate employee access. Zero Trust segmentation would likely have reduced the blast radius of compromised employee credentials across internal systems.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial employment-based access would likely still succeed, but CNSF visibility would enable earlier detection of anomalous remote access patterns and device behaviors during onboarding processes

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust policies would likely have limited the scope of legitimate employee credentials, constraining access to only specifically authorized resources rather than broad internal system privileges

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely have constrained movement between departmental resources and cloud environments, limiting the attacker's ability to access systems beyond their assigned role scope

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility would likely have detected and flagged anomalous VPN traffic patterns and unauthorized remote access tool usage across cloud environments and network segments

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress controls would likely have blocked or flagged unauthorized data transfers to external file-sharing services and restricted access to suspicious meeting recording capabilities

Impact (Mitigations)

While some organizational impact would likely remain due to legitimate employee access, the scope of intellectual property theft and data exposure would be significantly reduced through segmentation controls

Impact at a Glance

Affected Business Functions

  • Remote Workforce Management
  • Identity Verification Systems
  • Payroll and HR Operations
  • Internal Communications and Collaboration
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $1,970,000

Data Exposure

Internal company communications, proprietary development work, employee personal information, payroll systems access, and potential intellectual property. DPRK workers recorded internal meetings and had access to legitimate work systems across multiple sectors including healthcare, financial services, and technology companies.

Recommended Actions

  • • Implement Zero Trust Segmentation to limit access scope for all employees, especially remote workers, preventing lateral movement even with legitimate credentials
  • • Deploy Egress Security & Policy Enforcement to monitor and control all outbound communications, file transfers, and external service access by employees
  • • Enable Multicloud Visibility & Control to detect anomalous behaviors such as unusual VPN usage patterns, suspicious file downloads, and meeting recording activities
  • • Establish Threat Detection & Anomaly Response capabilities to identify behavioral indicators like repeated proxy connections, identity inconsistencies, and unusual remote access tool usage
  • • Strengthen Cloud Native Security Fabric controls to provide real-time inspection and enforcement during the employment verification process and ongoing employee activity monitoring

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image