‼️ A suspected North Korean IT worker was hired by a South Korean firm under a false identity and did real development work, police say.
It is the South's first known case. Police are tracing the pay.
The probe began in February 2025 and surfaced only when a lawmaker asked.
It is the South's first known case. Police are tracing the pay.
The probe began in February 2025 and surfaced only when a lawmaker asked.
Oct 24, 2026 · 12:33 PM UTC
13
11
188
18,415
@IntCyberDigest Did anything in his commits or access patterns look off to the team, or did it only come out through the pay trail?
0
0
0
332
@IntCyberDigest The tell in the US cases was laptop farms: the company laptop running an IP-KVM or a remote desktop tool. Alert on AnyDesk, Chrome Remote Desktop and TeamViewer installs on dev laptops, and only ship hardware to the address on payroll.
0
0
0
177
@IntCyberDigest MSP side of this: the tell is rarely the interview, it's the laptop. Ship-to address that doesn't match the hire's city, remote access tools installed day one, logins from odd egress IPs. Make IT sign off on device enrollment before HR closes onboarding.
0
0
0
99
@IntCyberDigest Notice who caught it: police, not the employer, and the worker was doing real dev work. Hiring is identity proofing. I'd tie the person from the interview to the onboarded account with a live ID check, then keep a new dev's repo and secrets access narrow until it's earned.
0
0
0
151
@IntCyberDigest plot twist: he was the only dev on the team actually closing his jira tickets
0
0
1
147
@IntCyberDigest He passed the interview, shipped real code and got paid. The probe sat quiet since February 2025 until a lawmaker asked. How many HR teams are checking payroll right now?
0
0
0
55
@IntCyberDigest The tell usually isn't the interview, it's the payroll. Pay going to a third-party account, the laptop shipped to a different address than the ID, logins from a VPN that never sleeps. Check where the money and the hardware go, not just the CV.
0
0
0
177
@IntCyberDigest "did real development work" is the part nobody knows what to do with
0
0
1
39
@IntCyberDigest i mean south K did want to end with North K no? this gives them some plausibility
0
0
0
48