North Korean Hacker Lands Remote IT Job, Caught After VPN Slip

Research from LevelBlue describes a suspected North Korean operative who bypassed hiring checks to obtain a remote IT position with access to Salesforce data, using Astrill VPN to mask origin (initially showing logins from China, then an anomalous login from St. Louis). Behavioural analytics and crowdsourced threat data detected the anomaly, the EntraID account was revoked within 10 days, and the report links this incident to an organized state-sponsored recruitment ecosystem that monetizes access and can support data exfiltration.