North Korean hacker got hired by US security vendor loaded malware

KnowBe4, a US security vendor, inadvertently hired a North Korean hacker who attempted to introduce malware into the company's network. The individual used a valid but stolen US identity and an AI-enhanced photo to pass through the hiring process, which included background checks and video interviews. Upon receiving their workstation, the hacker began loading malware, which was detected by KnowBe4's Security Operations Center (SOC). The SOC flagged suspicious activities, leading to an investigation. The hacker claimed to be troubleshooting a router issue but became unresponsive when questioned further. KnowBe4's analysis suggested that the malware loading might have been intentional, raising suspicions of the individual being an "Insider Threat/Nation State Actor." The company has since shared its findings with cybersecurity experts and the FBI, which is now investigating the incident. KnowBe4 emphasized that no illegal access was gained, and no data was compromised. The incident serves as a cautionary tale about the vulnerabilities in hiring processes, particularly regarding identity verification. The hacker may have been operating remotely from North Korea or nearby, potentially using the job to fund illegal activities. KnowBe4 highlighted the importance of stringent security measures for new employees in sensitive areas to prevent similar occurrences in the future.