New North Korean AI Hiring Scheme Targets US Companies

A suspected DPRK-linked operator attempted to secure remote employment at a cybersecurity firm using stolen identities, AI-generated résumés, fake LinkedIn profiles, and anonymized infrastructure; investigators uncovered signs of a broader campaign including clustered corporate laptops (a "laptop farm"), PiKVM hardware-level remote control, Astrill VPN and Tailscale use, and VoIP number spoofing. Pre-hire OSINT and targeted interview techniques exposed behavioral and technical red flags, and the report recommends layered pre-hire validation, least-privilege onboarding, device controls, and ongoing monitoring to mitigate such hiring pipeline insider threats.