Biz hired, and fired, a fake North Korean IT worker – then the ransom demands began

Secureworks documents an active North Korean campaign (attributed to Nickel Tapestry) that places fake remote IT contractors to establish persistent access, exfiltrate proprietary data (often to personal Google Drive locations), and then extort victims with six-figure cryptocurrency ransom demands; observed indicators and TTPs include use of Chrome Remote Desktop, AnyDesk (linked to Astrill VPN IPs), SplitCam virtual webcam software, laptop rerouting, and the use of payment services like Payoneer—organizations are advised to verify candidates, restrict unsanctioned remote access, and monitor onboarding financial changes.