Connect with us

Business

North Korea may have agents inside your company. 6 signs to look for

Published

on



Michael Barnhart is an investigator at DTEX Systems focused on North Korea.

They showed up on time, crushed deadlines, asked no questions.

It was a bit weird they never turned their camera on, but not a deal breaker.

Then they were gone.

No notice. No forwarding details. Just silence.

Across industries, some of the highest-performing remote workers are vanishing without a trace. For many companies, it’s not a burnout issue—it’s a breach of trust. And in more cases than you’d think, the root cause traces back to the Democratic People’s Republic of Korea (DPRK).

On June 30, the FBI and Department of Justice announced one of the largest crackdowns yet on North Korea’s remote IT worker scheme, designed to covertly fund the regime. Nearly 30 “laptop farms” across 16 U.S. states were raided for their suspected role. The coordinated action included three indictments, one arrest, the seizure of 29 financial accounts, and the takedown of 21 websites, part of a sweeping effort to disrupt covert operations and stop sanctioned workers from infiltrating global companies under false identities.

The bust marks a rare and direct strike against one of the world’s most evasive cyber adversaries.

North Korea’s shadow IT workforce isn’t just a sanctions workaround. It’s a global, for-profit operation embedding operatives inside major companies under false identities funneling money, access, and opportunity back to the regime. And if you think you’d spot it, you probably won’t. These workers are quiet by design, skilled by necessity, and trained to exploit the blind spots in modern remote work.

The scale of this infiltration is greater than many realize—and the indictments are unlikely to be the last. For now, every company should be asking: Could this be us?

Six red flags you hired a North Korean IT worker

Evading detection and blending into the background is DPRK tradecraft 101. But with the right behavioral analytics and cross-functional vigilance, patterns emerge. Here’s what to watch for:

  1. Run known DPRK-linked IOCs against your systems
    Start with what’s public. Known Indicators of Compromise (IOCs) tied to DPRK operations are readily available. Cross-reference them with your email logs, ticketing systems, and access records. If you find a hit, you might already be compromised.
  2. Odd working hours for alleged U.S.-based staff
    A remote dev claiming to be in Austin but pushing commits at 3 a.m. local time? That’s not hustle—that’s a time zone mismatch. DPRK operatives often work from China or Russia and adjust their hours to avoid detection. Look for strange bursts of late-week activity or unnatural work cadences.
  3. Use of remote access tools and anonymizers
    IP-KVM switches. Mouse automation tools. Anonymizing VPNs and remote desktop protocols. These aren’t just IT oddities—they’re DPRK staples. If you’re seeing remote access patterns that don’t match declared user behavior, or tooling that simulates presence, investigate.
  4. Unusually low communication engagement
    Camera always off. Silent in Slack. No questions, no friction. In many organizations, that’s seen as a plus. But low engagement, especially from critical roles, is a tell. DPRK operatives play invisible. That silence is often the signal. DPRK operatives are trained to stay invisible. In some cases, that quiet isn’t just disengagement—it’s operational cover. Several fake workers recently vanished not because they quit, but because their devices were seized in international stings. When someone goes dark, it may not be ghosting—law enforcement might be calling next about your company’s compromised systems.
  5. Resume or referral patterns that feel too familiar
    Look closer at your hiring pipeline. Reused resumes. Recycled phrasing. Overlapping career timelines. These are signs of templated personas. DPRK operatives often enter via fake recruiters or refer other DPRK workers in their group. When candidates start to blur together, it’s time to dig deeper.
  6. Discrepancy between interview and on-the-job performance
    Crushed the interview. Fell flat on day one. It happens, but when the person in the job doesn’t match the person who interviewed, that’s a problem. Voice changers, stand-ins, and deepfakes have all been used to slip through screenings. Even a quick follow-up can surface inconsistencies.

I hired a DPRK worker. Now what?

Step one: Don’t panic. Step two: Move fast.

When sensitive customer data or intellectual property may have been exposed, your response must be immediate, coordinated, and comprehensive.

Here’s what to do next:

  1. Immediate containment and isolation
    Suspend all access immediately—VPNs, cloud platforms, code repos, and email. Quarantine devices and preserve them for forensic analysis; don’t wipe or reset anything. Reset all related credentials to prevent further access. Fast action here matters. Every minute counts in preventing data theft or sabotage.
  2. Comprehensive forensic investigation
    Bring in experts experienced with insider threats and DPRK tactics. Analyze logs from networks, cloud, endpoints, and code repositories to uncover unusual access or data exfiltration. What did they touch? Where did the data flow? Look for covert data transfers or attempts to hide activity.
  3. Assess the scope of exposure
    Did they access customer data, IP, source code, or regulated content? Evaluate compliance exposure under GDPR, HIPAA, or CCPA. Risk isn’t limited to theft—think extortion, ransomware, or deeper compromise.
  4. Coordinate cross-functional response
    Bring in legal, PR, and HR. Legal advises on disclosure; PR preps messaging; HR manages internal fallout. The faster you coordinate, the more control you maintain.
  5. Engage external authorities
    Loop in law enforcement, including the Internet Crime Complaint Center (IC3) and the Department of Defense Cyber Crime Center (DC3). These aren’t just corporate risks; they’re geopolitical ones. Sharing intelligence strengthens your position and may help prevent future breaches.

Prevention beyond cyber and HR

Running known IOCs is a start—and a clean report is good news. But DPRK ops move fast. Prevention requires behavior-based visibility and tight cross-team alignment.

Pre-hire protective measures:

  • Conduct live, on-camera interviews with IP/geolocation validation
  • Independently verify references and past employment
  • Use unscripted, technical Q&A to gauge real expertise
  • Involve HR and legal early in security awareness and hiring processes

Post-hire protective measures:

  • Flag re-applications using recycled data or aliases
  • Monitor for unusual access times, remote tool use, and VPN spikes
  • Track engagement levels—silence is a signal
  • Watch for early signs of extortion, evasion, or data misuse

By fostering close collaboration across internal and external security, HR, risk, and legal teams, organizations can build a resilient insider risk program that detects and mitigates threats before they escalate. Prevention is a team effort, and behavior is the strongest signal.

North Korea—what’s next

The latest and ongoing government actions have pushed the DPRK’s shadow workforce into the spotlight. But exposure isn’t elimination. The playbook will evolve—new names, new tools, new countries.

The modern insider won’t always look suspicious. They’ll look perfect. Until they disappear.

Knowing what to look for is step one. Shutting it down for good is the mission ahead.

The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

Read more:



Source link

Continue Reading

Business

Hero bystander who tackled Bondi gunman praised by Trump, Ackman

Published

on



A bystander who rushed and disarmed one of the Bondi Beach attackers has won praise from leaders around the world, including US President Donald Trump and hedge fund billionaire Bill Ackman, who announced a reward program for community heroes.

Extraordinary footage of the civilian’s actions began circulating on social media on Sunday, shortly after two men, later identified as a father and son, started shooting into a crowd gathered to celebrate the first day of Hanukkah. The massacre has left at least 16 people dead in the worst terrorist attack in Australia’s history. 

Read More: Sixteen People Killed in Bondi Beach Hanukkah Terror Attack 

In the mobile-phone video, which has not been verified by Bloomberg News, one of the attackers is standing near a tree and firing. A few meters away, a crouched man emerges from behind a parked car. He grabs the shooter from behind and wrestles the weapon from his hands. Local media named the bystander as Ahmed el Ahmed, a 43-year-old father-of-two from south Sydney. He was shot twice and is being treated in the hospital, according to reports.

He was also soon lauded for his feat. Trump said at the White House that Ahmed had saved many lives and expressed “great respect” for him. In Sydney, New South Wales Premier Chris Minns went further, describing Ahmed’s wrestle with the shooter as “the most unbelievable scene I’ve ever seen.”

“That man is a genuine hero and I’ve got no doubt there are many, many people alive tonight as a result of his bravery,” Minns said at a press conference late Sunday.

Australian Prime Minister Anthony Albanese also praised Ahmed, and other bystanders who helped treat victims in the immediate aftermath of the shooting. 

“People rushing towards danger to show the best of the Australian character,” Albanese told reporters Monday. “That’s who we are, people who stand up for our values.” 

Pershing Square Capital Management’s founder Ackman called Ahmed  “a brave hero” and said his hedge fund firm would establish a reward program for people who had carried out similar acts.

The top donor to a gofundme page set up for the “hero” who tackled the shooter is listed as William Ackman, who gave $99,999. More than $170,000 has been raised so far. 

Salesforce Inc. Founder and Chief Executive Officer Marc Benioff also expressed his gratitude for Ahmed in a post on X.



Source link

Continue Reading

Business

A ‘new era’ in the housing market is about to begin as affordability finally improves

Published

on



Next year should mark a shift in the housing market after years of largely being frozen in place, according to Mike Simonsen, chief economist at top residential real estate brokerage Compass.

Home sales flatlined amid unaffordable conditions after rising demand collided with tepid supply growth, pushing up home prices. Would-be buyers became so discouraged that demand cooled and remains slow.

Prices are now becoming more favorable for house hunters, a trend that should continue in 2026 and change the narrative in the housing market.

“In the next era, that story flips. So sales are starting to move higher, but prices are capped or maybe down. Incomes are rising faster than prices, and so affordability improves for the first time in a bunch of years,” Simonsen told CNBC on Friday. “It’s not a dramatic improvement, but it’s the start of the new era.” 

His view echoes a recent report from Redfin, which also cited stronger income and weaker homes prices as it predicted a “Great Housing Reset” in 2026.

In addition to potential buyers giving up on finding an affordable home, sellers have been giving up on finding someone willing to buy at the price they want.

As a result, the number of homes that were withdrawn from the market jumped this year. In June, these so-called delistings shot up 47% from a year earlier.

Simonsen said listing withdrawals tend to be owner-occupied homes, meaning they could be latent demand as well as supply. That’s because two transactions would be needed: owners want to buy a new home but must sell their current one.

“In an environment where conditions improve a little bit, we actually estimate that that’s a representation of shadow demand—people that want to move, people that have delayed moves for maybe four years now,” he said, adding that there are about 150,000 such homeowners.

His housing market outlook for a new era of improving affordability doesn’t depend on a steep drop in mortgage rates. In fact, a plunge might spur so much demand that prices would overheat.

Simonsen expects rates to stay in the low-6% range, allowing sales to grow while also keeping home prices in check as more inventory comes on the market.

The price environment is already showing auspicious signs for prospective buyers. More than half of U.S. homes have dropped in value over the last year, but homeowners can still sell with a net gain as values are up a median 67% since their home’s last sale, accordion to data from Zillow.

And a separate report fromZillow found that homebuyers are getting record-high discounts. While the typical individual discount remains $10,000, desperate sellers are increasingly offering multiple reductions as muted demand leaves homes on the market for longer. As a result, the cumulative price cut in October hit $25,000.

“Most homeowners have seen their home values soar over the past several years, which gives them the flexibility for a price cut or two while still walking away with a profit,” Zillow Senior Economist Kara Ng said in a statement last month. “These discounts are bringing more listings in line with buyers’ budgets, and helping fuel the most active fall housing market in three years. Patient buyers are reaping the rewards as the market continues to rebalance.”



Source link

Continue Reading

Business

Attacker who killed US troops in Syria was a recent recruit to security forces

Published

on



A man who carried out an attack in Syria that killed three U.S. citizens had joined Syria’s internal security forces as a base security guard two months earlier and was recently reassigned amid suspicions that he might be affiliated with the Islamic State group, a Syrian official told The Associated Press Sunday.

The attack Saturday in the Syrian desert near the historic city of Palmyra killed two U.S. service members and one American civilian and wounded three others. It also wounded three members of the Syrian security forces who clashed with the gunman, interior ministry spokesperson Nour al-Din al-Baba said.

Al-Baba said that Syria’s new authorities had faced shortages in security personnel and had to recruit rapidly after the unexpected success of a rebel offensive last year that intended to capture the northern city of Aleppo but ended up overthrowing the government of former President Bashar Assad.

“We were shocked that in 11 days we took all of Syria and that put a huge responsibility in front of us from the security and administration sides,” he said.

The attacker was among 5,000 members who recently joined a new division in the internal security forces formed in the desert region known as the Badiya, one of the places where remnants of the Islamic State extremist group have remained active.

Attacker had raised suspicions

Al-Baba said the internal security forces’ leadership had recently become suspicious that there was an infiltrator leaking information to IS and began evaluating all members in the Badiya area.

The probe raised suspicions last week about the man who later carried out the attack, but officials decided to continue monitoring him for a few days to try to determine if he was an active member of IS and to identify the network he was communicating with if so, al-Baba said. He did not name the attacker.

At the same time, as a “precautionary measure,” he said, the man was reassigned to guard equipment at the base at a location where he would be farther from the leadership and from any patrols by U.S.-led coalition forces.

On Saturday, the man stormed a meeting between U.S. and Syrian security officials who were having lunch together and opened fire after clashing with Syrian guards, al-Baba said. The attacker was shot and killed at the scene.

Al-Baba acknowledged that the incident was “a major security breach” but said that in the year since Assad’s fall “there have been many more successes than failures” by security forces.

In the wake of the shooting, he said, the Syrian army and internal security forces “launched wide-ranging sweeps of the Badiya region” and broke up a number of alleged IS cells. The interior ministry said in a statement later that five suspects were arrested in the city of Palmyra.

A delicate partnership

The incident comes at a delicate time as the U.S. military is expanding its cooperation with Syrian security forces.

The U.S. has had forces on the ground in Syria for over a decade, with a stated mission of fighting IS, with about 900 troops present there today.

Before Assad’s ouster, Washington had no diplomatic relations with Damascus and the U.S. military did not work directly with the Syrian army. Its main partner at the time was the Kurdish-led Syrian Democratic Forces in the country’s northeast.

That has changed over the past year. Ties have warmed between the administrations of U.S. President Donald Trump and Syrian interim President Ahmad al-Sharaa, the former leader of an Islamist insurgent group Hayat Tahrir al-Sham that used to be listed by Washington as a terrorist organization.

In November, al-Sharaa became the first Syrian president to visit Washington since the country’s independence in 1946. During his visit, Syria announced its entry into the global coalition against the Islamic State, joining 89 other countries that have committed to combating the group.

U.S. officials have vowed retaliation against IS for the attack but have not publicly commented on the fact that the shooter was a member of the Syrian security forces.

Critics of the new Syrian authorities have pointed to Saturday’s attack as evidence that the security forces are deeply infiltrated by IS and are an unreliable partner.

Mouaz Moustafa, executive director of the Syrian Emergency Task Force, an advocacy group that seeks to build closer relations between Washington and Damascus, said that is unfair.

Despite both having Islamist roots, HTS and IS were enemies and often clashed over the past decade.

Among former members of HTS and allied groups, Moustafa, said, “It’s a fact that even those who carry the most fundamentalist of beliefs, the most conservative within the fighters, have a vehement hatred of ISIS.”

“The coalition between the United States and Syria is the most important partnership in the global fight against ISIS because only Syria has the expertise and experience to deal with this,” he said.

Later Sunday, Syria’s state-run news agency SANA reported that four members of the internal security forces were killed and a fifth was wounded after gunmen opened fire on them in the city of Maarat al-Numan in Idlib province.

It was not immediately clear who the gunmen were or whether the attack was linked to the Saturday’s shooting.



Source link

Continue Reading

Trending

Copyright © Miami Select.