North Korean hacker got hired by US security vendor loaded malware

KnowBe4, a US security vendor, inadvertently hired a North Korean hacker who attempted to introduce malware into the company's network. The individual used a valid but stolen US identity and an AI-enhanced photo to pass background checks and interviews. Upon receiving a company-issued Mac workstation, the hacker began loading malware, which was detected by KnowBe4's Security Operations Center (SOC). The SOC flagged suspicious activities, including attempts to manipulate session history files and transfer harmful files. The hacker claimed to be troubleshooting a router issue but later became unresponsive when contacted by the SOC. KnowBe4's CEO, Stu Sjouwerman, emphasized that no illegal access was gained, and no data was compromised, framing the incident as a learning opportunity for the organization. The company has since shared its findings with cybersecurity experts and the FBI, suspecting the hacker may have been operating as an insider threat or nation-state actor. The hacker likely worked remotely from North Korea or nearby, using a VPN to appear as if they were in the US. KnowBe4 highlighted the importance of stringent hiring practices and the need for robust security measures, especially for new employees in sensitive roles. The incident serves as a cautionary tale for other organizations about the potential risks of identity theft and insider threats in the cybersecurity landscape.