[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fle6svBVX2BXLH-42hFljlsRU60RhIV9gqT8y6vc-eWg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"50997883-63f1-44a5-a8c0-75363c638c34","Suspected North Korean IT workers reached onboarding at companies with open data","suspected-north-korean-it-workers-reached-onboarding-at-companies-with-open-data-71c043","Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year. At one company where a persona got that far in the past month, about 277,000 files containing Social Security numbers were shared company-wide or by public link. The personas are fabricated job seekers, complete with résumés and faces, applying for remote engineering roles. Over the year, 2,429 of … More → The post Suspected North Korean IT workers reached onboarding at companies with open data appeared first on Help Net Security.","Material Security tracked 27 suspected North Korean fake IT worker personas who reached the onboarding stage at monitored organizations over one year. At one company, a persona gained access to approximately 277,000 files containing Social Security numbers that were shared company-wide or via public links. These fabricated job seekers apply for remote engineering roles, and those who successfully onboarded would have had trusted access from day one.","North Korean IT workers infiltrated companies, reaching onboarding with access to sensitive data.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fnorth-korean-it-workers-onboarding\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12094429\u002Ffake-it-worker-1500.webp","2026-11-13T06:00:22+00:00","2026-11-13T08:00:19.212132+00:00",7,[17,20],{"name":18,"type":19},"North Korea","threat_actor",{"name":21,"type":22},"Material Security","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":49,"vendors":134},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":80,"name":81,"problem":82,"products":83},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":109,"name":110,"problem":111,"products":112},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":130,"product_name":131,"url":132,"description":133},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"north-korean-fake-it-workers-reached-onboarding-and-accessed-sensitive-employee-data","North Korean Fake IT Workers Reached Onboarding and Accessed Sensitive Employee Data","Over a one-year period, 27 suspected North Korean personas successfully navigated the hiring process to reach the onboarding stage at real companies, with one gaining access to approximately 277,000 files containing Social Security numbers. The core failure was treating a newly hired remote employee as an immediately trusted insider without validating their true identity or limiting their initial access to only what was necessary for their role. Files containing sensitive PII should never be shared company-wide or via open public links, as this dramatically amplifies the damage any malicious insider—fake or otherwise—can cause. This incident highlights that the hiring pipeline itself is an attack surface, and that identity verification, least-privilege access provisioning, and data governance must be treated as security controls, not HR formalities.",[140,141,142,143,144],"NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-53 AC-6: Least Privilege","CIS Control 3: Data Protection","NIS2 Article 21(2)(i)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(i)":146,"CIS Control 3: Data Protection":147,"MITRE ATT&CK T1078: Valid Accounts":148,"NIST SP 800-53 AC-6: Least Privilege":149,"NIST SP 800-53 PS-3: Personnel Screening":150},"This point covers human resources security and access control, directly requiring that personnel vetting and access provisioning processes are designed to prevent unauthorized or malicious actors from gaining trusted system access.","CIS Control 3 requires organizations to inventory, classify, and restrict access to sensitive data, which would have prevented Social Security number files from being accessible via open company-wide or public links.","The North Korean personas exploited legitimately provisioned employee accounts to gain trusted insider access, which is the core technique T1078 describes.","AC-6 mandates that users are granted only the access required for their role, which would have prevented a new hire from reaching 277,000 sensitive files on day one.","PS-3 requires organizations to screen individuals prior to authorizing access to systems, which would have flagged the fabricated identities before onboarding was completed."]