2 August 2022

North Korean cyber thieves steal LinkedIn resumes to get a job at crypto companies


North Korean cyber thieves steal LinkedIn resumes to get a job at crypto companies

Suspected North Korean scammers are plagiarizing resumes and pretending to be from other countries to raise money for the North Korean government, Bloomberg reports.

As per security researchers at Mandiant, the scammers browse job listings on LinkedIn and Indeed and incorporate details they find in legitimate profiles into their own resumes in attempt to get hired by US cryptocurrency companies.

One applicant identified by Mandiant on July 14 claimed to be an “innovative and strategic thinking professional” adding that “The world will see the great result from my hands.” The identified account claimed to be from experienced software developer, however, the researchers found nearly identical language in another applicant’s account.

Other suspected scammers provided fake job qualifications, with some users claiming on job applications to have published a white paper about the Bibox digital currency exchange, while another pretended to be a senior software developer at a consultancy focused on blockchain technology.

Mandiant said they had identified multiple suspected North Korean personas on employment sites that have successfully been hired as freelance employees. The researchers declined to name the employers.

Based on information collected from crypto companies North Korea can gather intel about cryptocurrency trends, which could give the country’s government an edge in how to launder cryptocurrency in a way that helps Pyongyang avoid sanctions, the cybersecurity company says.

Mandiant’s findings reaffirm the previous warning of the US Department of State, the Department of the Treasury, and the Federal Bureau of Investigation about Democratic People’s Republic of Korea (DPRK) dispatching thousands of highly skilled IT workers around the world to generate revenue for the country's government.


Back to the list

Latest Posts

China-linked LightSpy iOS implant re-emerges, targets South Asia

China-linked LightSpy iOS implant re-emerges, targets South Asia

LightSpy contains modules designed to exfiltrate device information and saved files.
16 April 2024
Cryptojacker indicted for defrauding cloud service providers of $3.5M

Cryptojacker indicted for defrauding cloud service providers of $3.5M

Parks allegedly manipulated the cloud providers into granting him elevated privileges and benefits.
16 April 2024
Firebird RAT developers and sellers arrested in the US and Australia

Firebird RAT developers and sellers arrested in the US and Australia

The malware allows to remotely access victims' computers and perform illicit activities.
16 April 2024