The man on the other end, an FBI agent, told Devin that the seemingly legitimate software developer he’d hired the previous summer was a North Korean operative who’d sent tens of thousands of dollars of his salary to the country’s authoritarian regime.
Stunned, Devin hung up and immediately cut the employee off from company accounts, he said.
“He was a good contributor,” Devin lamented, puzzled by the man who had claimed to be Chinese and passed multiple rounds of interviews to get hired. (CNN is using a pseudonym for Devin to protect the identity of his company).
Now, US federal investigators are publicly warning about a key pillar of the North Korean strategy, in which the regime places operatives in tech jobs throughout the information technology industry.
It’s an elaborate money-making scheme that relies on front companies, contractors and deception to prey on a volatile industry that is always on the hunt for top talent. North Korean tech workers can earn more than $300,000 annually — hundreds of times the average income of a North Korean citizen — and up to 90% of their wages go to the regime, according to the US advisory.
“(The North Koreans) take this very seriously,” said Soo Kim, a former North Korea analyst at the CIA. “It’s not just some rando in his basement trying to mine cryptocurrency,” she added, referring to the process of generating digital money. “It’s a way of life.”
But analysts say the cryptocurrency industry is too valuable a target for North Korean operatives to turn away from because of the industry’s relatively weak cyber defenses and the role that cryptocurrency can play in evading sanctions.
US officials have in recent months held a series of private briefings with foreign governments such as Japan, and with tech firms in the US and abroad, to sound the alarm about the threat of North Korean IT personnel, a Treasury Department official who specializes in North Korea told CNN.
The list of companies targeted by North Koreans covers just about every aspect of the freelance technology sector, including payment processors and recruiting firms, the official said.
“Treasury will continue to target the DPRK’s revenue generating efforts, including its illicit IT worker program and related malign cyber activities,” Brian Nelson, Treasury undersecretary for terrorism and financial intelligence, said in a statement to CNN, using the acronym for North Korea.
CNN has emailed and called the North Korean Embassy in London seeking comment.
Federal investigators are also on the lookout for Americans who may be inclined to lend their expertise in digital currencies to North Korea.
In April, a 39-year-old American computer programmer named Virgil Griffith was sentenced to more than five years in US prison for violating US sanctions on North Korea after speaking at a blockchain conference there in 2019 on how to evade sanctions. Griffith pleaded guilty and, in a statement submitted to the judge before sentencing, expressed “deep regret” and “shame” for his actions, which he attributed to an obsession to see North Korea “before it fell.”
But the long-term challenge facing US officials is much subtler than conspicuous blockchain conferences in Pyongyang. It involves trying to curtail the diffuse sources of funding that the North Korean government gets from its tech diaspora.
Double-edged sword
The North Korean government has long benefited from outsiders underestimating the regime’s ability to fend for itself, thrive in the black market and exploit the information technology that underpins the global economy.
One of the most infamous North Korean hacks occurred in 2014 with the crippling of Sony Pictures Entertainment’s computer systems in retaliation for “The Interview,” a movie involving a fictional plot to kill Kim Jong Un. Two years later, North Korean hackers stole some $81 million from the Bank of Bangladesh by exploiting the SWIFT system for transferring bank funds.
North Korea’s hacking teams have in the years since trained their sights on the boom-and-bust cryptocurrency market.
The returns have been astronomical at times.
“Most of these crypto firms and services are still a long way off from the security posture that we see with traditional banks and other financial institutions,” said Fred Plan, principal analyst at cybersecurity firm Mandiant, which investigated suspected North Korean tech workers and shared some of its findings with CNN.
The thousands of North Korean tech workers overseas give Pyongyang a double-edged sword: They can earn salaries that skirt UN and US sanctions and go straight to the regime while also occasionally offering North Korea-based hackers a foothold into cryptocurrency or other tech firms. The IT workers sometimes provide “logistical” support to the hackers and transfer cryptocurrency, the recent US government advisory said.
“The community of skilled programmers in North Korea with permission to contact Westerners is surely quite small,” Nick Carlsen, who until last year was an FBI intelligence analyst focused on North Korea, told CNN.
“These guys know each other. Even if a particular IT worker isn’t a hacker, he absolutely knows one,” said Carlsen, who now works at TRM Labs, a firm that investigates financial fraud. “Any vulnerability they might identify in a client’s systems would be at grave risk.”
“We actively seek out signs of state-sponsored activity on the platform and quickly take action against bad actors in order to protect our members,” LinkedIn said in a statement to CNN. “We don’t wait on requests, our threat intelligence team removes fake accounts using information we uncover and intelligence from a variety of sources, including government agencies.”
Learning to spot red flags
Some in the cryptocurrency industry are getting more cautious as they look to hire new talent. In Jonathan Wu’s case, a video call with a job candidate in April may have kept him from unwittingly hiring someone he came to suspect was a North Korean tech worker.
As head of growth marketing at Aztec, a company that offers privacy features for Ethereum, a popular type of cryptocurrency technology, Wu was looking for a new software engineer when the hiring team came across a promising résumé that someone had submitted.
The applicant claimed experience with non-fungible tokens (NFTs) and other segments of the cryptocurrency market.
“It looked like someone we might hire as an engineer,” Wu, who is based in New York, told CNN.
But Wu saw a number of red flags in the applicant, who gave his name as “Bobby Sierra.” He spoke in halting English during the interview, kept his web camera off, and could hardly keep his backstory straight as he practically demanded a job at Aztec, according to Wu.
Wu didn’t end up hiring “Sierra,” who claimed on his résumé to live in Canada.
“It sounded like he was in a call center,” Wu said. “It sounded like there were four or five guys in the office, also speaking loudly, also seemingly on interviews or phone calls and speaking a mix of Korean and English.”
“Sierra” did not respond to messages sent to his apparent email and Telegram accounts seeking comment.
CNN obtained the résumés the alleged North Korean tech workers submitted to Wu’s firm and the cryptocurrency startup founded by Devin. The résumés seem deliberately generic as to not arouse suspicion and used buzzwords popular in the cryptocurrency industry such as “scalability” and “blockchain.”
One suspected North Korean operative tracked by Mandiant, the cybersecurity firm, asked numerous questions of others in the cryptocurrency community about how Ethereum works and interacts with other technology, Mandiant said.
The North Korean may have been gathering information about the technology that could be useful for hacking it later, according to Mandiant principal analyst Michael Barnhart.
“These guys know exactly what they want from the Ethereum developers,” Barnhart said. “They know exactly what they’re looking for.”
The fake résumés and other ruses used by the North Koreans will likely only get more believable, said Kim,the former CIA analyst who is now a policy analyst at RAND Corp., a think tank.
“Even though the tradecraft is not perfect right now, in terms of their ways of approaching foreigners and preying upon their vulnerabilities, it’s still a fresh market for North Korea,” Kim told CNN. “In light of the challenges that the regime is facing — food shortages, fewer countries willing to engage with North Korea … this is just going to be something that they will continue to use because nobody is holding them back, essentially.”
