Connect with us

Business

North Korea may have agents inside your company. 6 signs to look for

Published

on



Michael Barnhart is an investigator at DTEX Systems focused on North Korea.

They showed up on time, crushed deadlines, asked no questions.

It was a bit weird they never turned their camera on, but not a deal breaker.

Then they were gone.

No notice. No forwarding details. Just silence.

Across industries, some of the highest-performing remote workers are vanishing without a trace. For many companies, it’s not a burnout issue—it’s a breach of trust. And in more cases than you’d think, the root cause traces back to the Democratic People’s Republic of Korea (DPRK).

On June 30, the FBI and Department of Justice announced one of the largest crackdowns yet on North Korea’s remote IT worker scheme, designed to covertly fund the regime. Nearly 30 “laptop farms” across 16 U.S. states were raided for their suspected role. The coordinated action included three indictments, one arrest, the seizure of 29 financial accounts, and the takedown of 21 websites, part of a sweeping effort to disrupt covert operations and stop sanctioned workers from infiltrating global companies under false identities.

The bust marks a rare and direct strike against one of the world’s most evasive cyber adversaries.

North Korea’s shadow IT workforce isn’t just a sanctions workaround. It’s a global, for-profit operation embedding operatives inside major companies under false identities funneling money, access, and opportunity back to the regime. And if you think you’d spot it, you probably won’t. These workers are quiet by design, skilled by necessity, and trained to exploit the blind spots in modern remote work.

The scale of this infiltration is greater than many realize—and the indictments are unlikely to be the last. For now, every company should be asking: Could this be us?

Six red flags you hired a North Korean IT worker

Evading detection and blending into the background is DPRK tradecraft 101. But with the right behavioral analytics and cross-functional vigilance, patterns emerge. Here’s what to watch for:

  1. Run known DPRK-linked IOCs against your systems
    Start with what’s public. Known Indicators of Compromise (IOCs) tied to DPRK operations are readily available. Cross-reference them with your email logs, ticketing systems, and access records. If you find a hit, you might already be compromised.
  2. Odd working hours for alleged U.S.-based staff
    A remote dev claiming to be in Austin but pushing commits at 3 a.m. local time? That’s not hustle—that’s a time zone mismatch. DPRK operatives often work from China or Russia and adjust their hours to avoid detection. Look for strange bursts of late-week activity or unnatural work cadences.
  3. Use of remote access tools and anonymizers
    IP-KVM switches. Mouse automation tools. Anonymizing VPNs and remote desktop protocols. These aren’t just IT oddities—they’re DPRK staples. If you’re seeing remote access patterns that don’t match declared user behavior, or tooling that simulates presence, investigate.
  4. Unusually low communication engagement
    Camera always off. Silent in Slack. No questions, no friction. In many organizations, that’s seen as a plus. But low engagement, especially from critical roles, is a tell. DPRK operatives play invisible. That silence is often the signal. DPRK operatives are trained to stay invisible. In some cases, that quiet isn’t just disengagement—it’s operational cover. Several fake workers recently vanished not because they quit, but because their devices were seized in international stings. When someone goes dark, it may not be ghosting—law enforcement might be calling next about your company’s compromised systems.
  5. Resume or referral patterns that feel too familiar
    Look closer at your hiring pipeline. Reused resumes. Recycled phrasing. Overlapping career timelines. These are signs of templated personas. DPRK operatives often enter via fake recruiters or refer other DPRK workers in their group. When candidates start to blur together, it’s time to dig deeper.
  6. Discrepancy between interview and on-the-job performance
    Crushed the interview. Fell flat on day one. It happens, but when the person in the job doesn’t match the person who interviewed, that’s a problem. Voice changers, stand-ins, and deepfakes have all been used to slip through screenings. Even a quick follow-up can surface inconsistencies.

I hired a DPRK worker. Now what?

Step one: Don’t panic. Step two: Move fast.

When sensitive customer data or intellectual property may have been exposed, your response must be immediate, coordinated, and comprehensive.

Here’s what to do next:

  1. Immediate containment and isolation
    Suspend all access immediately—VPNs, cloud platforms, code repos, and email. Quarantine devices and preserve them for forensic analysis; don’t wipe or reset anything. Reset all related credentials to prevent further access. Fast action here matters. Every minute counts in preventing data theft or sabotage.
  2. Comprehensive forensic investigation
    Bring in experts experienced with insider threats and DPRK tactics. Analyze logs from networks, cloud, endpoints, and code repositories to uncover unusual access or data exfiltration. What did they touch? Where did the data flow? Look for covert data transfers or attempts to hide activity.
  3. Assess the scope of exposure
    Did they access customer data, IP, source code, or regulated content? Evaluate compliance exposure under GDPR, HIPAA, or CCPA. Risk isn’t limited to theft—think extortion, ransomware, or deeper compromise.
  4. Coordinate cross-functional response
    Bring in legal, PR, and HR. Legal advises on disclosure; PR preps messaging; HR manages internal fallout. The faster you coordinate, the more control you maintain.
  5. Engage external authorities
    Loop in law enforcement, including the Internet Crime Complaint Center (IC3) and the Department of Defense Cyber Crime Center (DC3). These aren’t just corporate risks; they’re geopolitical ones. Sharing intelligence strengthens your position and may help prevent future breaches.

Prevention beyond cyber and HR

Running known IOCs is a start—and a clean report is good news. But DPRK ops move fast. Prevention requires behavior-based visibility and tight cross-team alignment.

Pre-hire protective measures:

  • Conduct live, on-camera interviews with IP/geolocation validation
  • Independently verify references and past employment
  • Use unscripted, technical Q&A to gauge real expertise
  • Involve HR and legal early in security awareness and hiring processes

Post-hire protective measures:

  • Flag re-applications using recycled data or aliases
  • Monitor for unusual access times, remote tool use, and VPN spikes
  • Track engagement levels—silence is a signal
  • Watch for early signs of extortion, evasion, or data misuse

By fostering close collaboration across internal and external security, HR, risk, and legal teams, organizations can build a resilient insider risk program that detects and mitigates threats before they escalate. Prevention is a team effort, and behavior is the strongest signal.

North Korea—what’s next

The latest and ongoing government actions have pushed the DPRK’s shadow workforce into the spotlight. But exposure isn’t elimination. The playbook will evolve—new names, new tools, new countries.

The modern insider won’t always look suspicious. They’ll look perfect. Until they disappear.

Knowing what to look for is step one. Shutting it down for good is the mission ahead.

The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

Read more:



Source link

Continue Reading

Business

Attacker who killed US troops in Syria was a recent recruit to security forces

Published

on



A man who carried out an attack in Syria that killed three U.S. citizens had joined Syria’s internal security forces as a base security guard two months earlier and was recently reassigned amid suspicions that he might be affiliated with the Islamic State group, a Syrian official told The Associated Press Sunday.

The attack Saturday in the Syrian desert near the historic city of Palmyra killed two U.S. service members and one American civilian and wounded three others. It also wounded three members of the Syrian security forces who clashed with the gunman, interior ministry spokesperson Nour al-Din al-Baba said.

Al-Baba said that Syria’s new authorities had faced shortages in security personnel and had to recruit rapidly after the unexpected success of a rebel offensive last year that intended to capture the northern city of Aleppo but ended up overthrowing the government of former President Bashar Assad.

“We were shocked that in 11 days we took all of Syria and that put a huge responsibility in front of us from the security and administration sides,” he said.

The attacker was among 5,000 members who recently joined a new division in the internal security forces formed in the desert region known as the Badiya, one of the places where remnants of the Islamic State extremist group have remained active.

Attacker had raised suspicions

Al-Baba said the internal security forces’ leadership had recently become suspicious that there was an infiltrator leaking information to IS and began evaluating all members in the Badiya area.

The probe raised suspicions last week about the man who later carried out the attack, but officials decided to continue monitoring him for a few days to try to determine if he was an active member of IS and to identify the network he was communicating with if so, al-Baba said. He did not name the attacker.

At the same time, as a “precautionary measure,” he said, the man was reassigned to guard equipment at the base at a location where he would be farther from the leadership and from any patrols by U.S.-led coalition forces.

On Saturday, the man stormed a meeting between U.S. and Syrian security officials who were having lunch together and opened fire after clashing with Syrian guards, al-Baba said. The attacker was shot and killed at the scene.

Al-Baba acknowledged that the incident was “a major security breach” but said that in the year since Assad’s fall “there have been many more successes than failures” by security forces.

In the wake of the shooting, he said, the Syrian army and internal security forces “launched wide-ranging sweeps of the Badiya region” and broke up a number of alleged IS cells. The interior ministry said in a statement later that five suspects were arrested in the city of Palmyra.

A delicate partnership

The incident comes at a delicate time as the U.S. military is expanding its cooperation with Syrian security forces.

The U.S. has had forces on the ground in Syria for over a decade, with a stated mission of fighting IS, with about 900 troops present there today.

Before Assad’s ouster, Washington had no diplomatic relations with Damascus and the U.S. military did not work directly with the Syrian army. Its main partner at the time was the Kurdish-led Syrian Democratic Forces in the country’s northeast.

That has changed over the past year. Ties have warmed between the administrations of U.S. President Donald Trump and Syrian interim President Ahmad al-Sharaa, the former leader of an Islamist insurgent group Hayat Tahrir al-Sham that used to be listed by Washington as a terrorist organization.

In November, al-Sharaa became the first Syrian president to visit Washington since the country’s independence in 1946. During his visit, Syria announced its entry into the global coalition against the Islamic State, joining 89 other countries that have committed to combating the group.

U.S. officials have vowed retaliation against IS for the attack but have not publicly commented on the fact that the shooter was a member of the Syrian security forces.

Critics of the new Syrian authorities have pointed to Saturday’s attack as evidence that the security forces are deeply infiltrated by IS and are an unreliable partner.

Mouaz Moustafa, executive director of the Syrian Emergency Task Force, an advocacy group that seeks to build closer relations between Washington and Damascus, said that is unfair.

Despite both having Islamist roots, HTS and IS were enemies and often clashed over the past decade.

Among former members of HTS and allied groups, Moustafa, said, “It’s a fact that even those who carry the most fundamentalist of beliefs, the most conservative within the fighters, have a vehement hatred of ISIS.”

“The coalition between the United States and Syria is the most important partnership in the global fight against ISIS because only Syria has the expertise and experience to deal with this,” he said.

Later Sunday, Syria’s state-run news agency SANA reported that four members of the internal security forces were killed and a fifth was wounded after gunmen opened fire on them in the city of Maarat al-Numan in Idlib province.

It was not immediately clear who the gunmen were or whether the attack was linked to the Saturday’s shooting.



Source link

Continue Reading

Business

AIIB’s first president defends China as ‘responsible stakeholder’ in less multilateral world

Published

on



When China wanted to set up its answer to the World Bank, it picked Jin Liqun—a veteran financier with experience at the World Bank, the Asian Development Bank, China’s ministry of finance and the China Investment Corporation, the country’s sovereign wealth fund—to design it. Since 2014, Jin has been the force behind the Asian Infrastructure Investment Bank, including a decade as its first president, starting in 2016. 

Jin’s decade-long tenure comes to an end on January 16, when he will hand over the president’s chair to Zou Jiayi, a former vice minister of finance. When Jin took over the AIIB ten years ago, the world was still mostly on a path to further globalization and economic integration, and the U.S. and China were competitors, not rivals. The world is different now: Protectionism is back, countries are ditching multilateralism, and the U.S. and China are at loggerheads. 

The AIIB has largely managed to keep its over-100 members, which includes many countries that are either close allies to the U.S.—like Germany, France and the U.K.—or have longstanding tensions with Beijing, like India and the Philippines.

But can the AIIB—which boasts China as its largest shareholder, and is closely tied to Beijing’s drive to be seen as a “responsible stakeholder”—remain neutral in a more polarized international environment? And can multilateralism survive with an “America First” administration in Washington?

After his decades working for multilateral organizations—the World Bank, the ADB, and now the AIIB—Jin remains a fan of multilateralism and is bullish on the prospects for global governance.

“I find it very hard to understand that you can go alone,” Jin tells Fortune in an interview. “If one of those countries is going to work with China, and then China would have negotiations with this country on trade, cross-border investment, and so on—how can they negotiate something without understanding the basics, without following the generally accepted rules?”

“Multilateralism is something you could never escape.”

Why did China set up the AIIB?

Beijing set up the Asian Infrastructure Investment Bank almost a decade ago, on Jan. 16, 2016. The bank grew from the aftermath of the Global Financial Crisis, when Chinese officials considered how best to use the country’s growing foreign exchange reserves. Beijing was also grumbling about its perceived lack of influence in major global economic institutions, like the International Monetary Fund and the World Bank, despite becoming one of the world’s most important economies.

With $66 billion in assets (according to its most recent financial statements), the Asian Infrastructure Investment Bank is smaller than its U.S.-led peers, the World Bank (with $411 billion in assets) and the Asian Development Bank (with $130 billion). But the AIIB was designed to be China’s first to design its own institutions for global governance and mark its name as a leader in development finance.

Negotiations to establish the bank started in earnest in 2014, as several Asian economies like India and Indonesia chose to join the new institution as members. Then, in early 2015, the U.K. made the shocking decision to join the AIIB as well; several other Western countries, like France, Germany, Australia, and Canada, followed suit.

Two major economies stood out in abstaining. The U.S., then under the Obama administration, chose not to join the AIIB, citing concerns about its ability to meet “high standards” around governance and environmental safeguards. Japan, the U.S.’s closest security ally in East Asia, also declined, ostensibly due to concerns about human rights, environmental protection, and debt.

“They chose not to join, but we don’t mind.” Jin says. “We still keep a very close working relationship with U.S. financial institutions and regulatory bodies, as well as Japanese companies.” He sees this relationship as proof of the AIIB’s neutral and apolitical nature.

Still, Beijing set up the AIIB after years of being lobbied by U.S. officials to become a “responsible stakeholder,” when then-U.S. Secretary of State Robert Zoellick defined in 2005 as countries that “recognize that the international system sustains their peaceful prosperity, so they work to sustain that system.”

Two decades later, U.S. officials see China’s presence in global governance as a threat, fearing that Beijing is now trying to twist international institutions to suit its own interests. 

Jin shrugs off these criticisms. “China is now, I think, the No. 2 contributor to the United Nations, and one of the biggest contributors to the World Bank and the Asian Development Bank” (ADB), Jin says. “Yet the per capita GDP for China is still quite lower than a number of countries. That, in my view, is an indication of its assumption of responsibility.”

And now, with several countries withdrawing from global governance, Jin thinks those lecturing China on being responsible are being hypocritical. “When anybody tells someone else ‘you should be a responsible member’, you should ask yourself whether I am, myself, a responsible man. You can’t say, ‘you’ve got to be a good guy.’ Do you think you are a good guy yourself?” he says, chuckling.

Why does China care about infrastructure?

From its inception, Beijing tried to differentiate the AIIB from the World Bank and the ADB through its focus on infrastructure. Jin credits infrastructure investment for laying part of the groundwork for China’s later economic boom.

“In 1980, China didn’t have any expressways, no electrified railways, no modern airports, nothing in terms of so-called modern infrastructure,” Jin says. “Yet by 1995, China’s economy started to take off. From 1995, other sectors—manufacturing, processing—mushroomed because of basic infrastructure.”

Still, Jin doesn’t see the AIIB as a competitor to the World Bank and the ADB, saying he’s “deeply attached” to both banks due to his time serving in both. “Those two institutions have been tremendous for Asian countries and many others around the world. But time moves forward, and we need something new to deal with new challenges, do projects more cost-effectively, and be more responsive.”

Jin is particularly eager to defend one particular institutional choice: the AIIB’s decision to have a non-resident board, with directors who don’t reside in the bank’s headquarters of Beijing. (Commentators, at the time of the bank’s inception, were concerned that a non-resident board would reduce transparency, and limit the ability of board directors to stay informed.)

“In order for management to be held accountable, in order for the board to have the real authoritative power to supervise and guide the management, the board should be hands-off. If the board makes decisions on policies and approves specific projects, the management will have no responsibility,” he says.

Jin says it was a lesson learned from the private sector. “The real owners, the board members, understand they should not interfere with the routine management of the institution, because only in so doing can they hold management responsible.”

“If the CEO is doing a good job, they can go on. If they are not doing a good job, kick them out.”

What does Jin Liqun plan to do next?

Jin Liqun was born in 1949, just a few months before the official establishment of the People’s Republic of China. He was sent to the countryside during the Cultural Revolution, and spent a decade first as a farmer, and eventually a teacher. He returned to higher education in 1978, getting a master’s in English Literature from Beijing Foreign Studies University.

From there, he made his way through an array of Chinese and international financial institutions: the World Bank, the Asian Development Bank, China’s Ministry of Finance, the China International Capital Corporation, and, eventually, the China Investment Corporation, the country’s sovereign wealth fund.

In 2014, Jin was put in charge of the body set up to create the AIIB. Then, in 2016, he was elected the AIIB’s first-ever president.

“Geopolitical tensions are just like the wind or the waves on the ocean. They’ll push you a little bit here and there,” Jin says. “But we have to navigate this rough and tumble in a way where we wouldn’t deviate from our neutrality and apolitical nature.” 

He admits “the sea was never calm” in his decade in office. U.S. President Donald Trump’s election in 2016 intensified U.S.-China competition, with Washington now seeing China’s involvement in global governance as a threat to U.S. power. 

Other countries have also rethought their membership in the AIIB: Canada suspended its membership in 2023 after a former Canadian AIIB director raised allegations of Chinese Communist Party influence among leadership. (The AIIB called the accusations “baseless and disappointing”). China is also the AIIB’s largest shareholder, holding around 26% of voting shares; by comparison, the U.S. holds about 16% of the World Bank’s voting shares.

Still, several countries that have tense relations with China, like India and the Philippines, have maintained their ties with the AIIB. “We managed to overcome a lot of difficulty which arose from disputes between some of our members, and we managed to overcome some difficulty arising from conflicts around the world,” he said.

“Staff of different nationalities did not become enemies because their governments were having problems with each other. We never had this kind of problem.”



Source link

Continue Reading

Business

JetBlue flight near Venezuela avoids midair collision with U.S. Air Force tanker

Published

on



A JetBlue flight from the small Caribbean nation of Curaçao halted its ascent to avoid colliding with a U.S. Air Force refueling tanker on Friday, and the pilot blamed the military plane for crossing his path.

“We almost had a midair collision up here,” the JetBlue pilot said, according to a recording of his conversation with air traffic control. “They passed directly in our flight path. … They don’t have their transponder turned on, it’s outrageous.”

The incident involved JetBlue Flight 1112 from Curaçao, which is just off the coast of Venezuela, en route to New York City’s JFK airport. It comes as the U.S. military has stepped up its drug interdiction activities in the Caribbean and is also seeking to increase pressure on Venezuela’s government.

“We just had traffic pass directly in front of us within 5 miles of us — maybe 2 or 3 miles — but it was an air-to air-refueler from the United States Air Force and he was at our altitude,” the pilot said. “We had to stop our climb.” The pilot said the Air Force plane then headed into Venezuelan air space.

Derek Dombrowski, a spokesman for JetBlue, said Sunday: “We have reported this incident to federal authorities and will participate in any investigation.” He added, “Our crewmembers are trained on proper procedures for various flight situations, and we appreciate our crew for promptly reporting this situation to our leadership team.”

The Pentagon referred The Associated Press to the Air Force for comment. The Air Force didn’t immediately respond to a request for comment.

The Federal Aviation Administration last month issued a warning to U.S. aircraft urging them to “exercise caution” when in Venezuelan airspace, “due to the worsening security situation and heightened military activity in or around Venezuela.”

According to the air traffic recording, the controller responded to the pilot, “It has been outrageous with the unidentified aircraft within our air.”

Join us at the Fortune Workplace Innovation Summit May 19–20, 2026, in Atlanta. The next era of workplace innovation is here—and the old playbook is being rewritten. At this exclusive, high-energy event, the world’s most innovative leaders will convene to explore how AI, humanity, and strategy converge to redefine, again, the future of work. Register now.



Source link

Continue Reading

Trending

Copyright © Miami Select.