Cyber firm KnowBe4 hired a fake IT worker from North Korea

A North Korean state-linked threat actor created a convincing fake IT employee persona—using a stolen U.S. identity and AI-enhanced imagery—to gain remote employment at KnowBe4. The adversary loaded malware onto a company-issued laptop and performed various unauthorized actions (session-history manipulation, file transfers, execution), but the SOC detected and contained the activity quickly; no data was lost or exfiltrated. KnowBe4 shared findings with the FBI and Mandiant and is strengthening identity vetting and monitoring.