How to spot a North Korean agent before they get comfy inside payroll

Mandiant warns that North Korean agents are increasingly securing remote US IT jobs to funnel income to Pyongyang and gain long-term access to employer networks. The analysis identifies common indicators (multiple identities, stolen LinkedIn photos, mismatched education/address, laptop farms, VPN/KVM remote access) and recommends mitigations including biometric/notarized identity checks, camera-on interviews, background checks, monitoring for KVM/VPN traffic, verifying device serial numbers, and deploying hardware-based MFA.