North Korean Fake IT Workers Infiltrate Firms to Dodge Sanctions
ID: c6f0ac83-1d29-5e08-aba9-bcc5131c43fc
STIX ID: report--c6f0ac83-1d29-5e08-aba9-bcc5131c43fc
Feed Name: GBHackers
Threat Score
North Korean-linked operators are running an active campaign impersonating IT workers to secure freelance work and launder earnings; researchers tied the domain luckyguys.site to IPs 163.245.219.19 and 216.158.225.144 and observed concentrated VPN usage (notably Astrill and Mullvad), residential IP proxying, cloud service access (Gmail, ChatGPT, Workana), rapid infrastructure abandonment after public exposure, and recommendations to audit logs and treat VPN/residential IP signals as suspicious.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.