There may be agents inside North Korea’s company. 6 tokens to search

In time, they showed the deadlined deadlines, no questions were asked.

It was a little strange that they never turned their cameras, but the bargain is not break.

Then they went.

There is no warning. There are no forwarding details. Just silence.

Among the industries, some of the highest performed remote workers disappear without trace. For many companies, this is not a burning problem – it is a breach of confidence. In more cases, the root of the Korea (DPRK) causes the trail of the Korean Democratic People’s Republic.

The Ministry of FBI and Justice was declared on June 30 One of the biggest raids in North Korea’s remote dog workshopMode is designed to hide. According to the suspect roles, about 16 “laptops farm” were attacked by the 16th state of the United States. The coordinated action included three indispers, 29 financial accounts and seized 29 financial accounts and seized 21 websites, the sanctuary of global companies under secret personalists and sanctioned employees.

This bust celebrates a rare and direct strike on one of the most events of the world’s evacuity cyber enemies.

North Korea’s Shadow Workforce is not only an employee of sanctions. This is the opportunity to return money, access and regime within the forons for global, profit operation. And if you think you think of it, you will probably not do. These workers are calm with the design that teaches you to use blind spots in need of necessary and modern remote work.

The scale of this infiltration is greater than a lot, and the indictment is unlikely to be the last. So far, every company needs to ask: Can this make us?

North Korean IT employee you hire six red flags

The discovery and mixing in the background, DPRK Tradecraft is 101. However, examples are emerging with proper behavioral analysts and cross-functional vigilance. Here’s why you need to watch:

1. Ioks related to DPRK known to your systems
   Start what to the public. It is known that the compromise (ICS) related to garbage operations is easily available. Contact them with your email notes, ticketing systems and access notes. If you find a hit, you can already compromise.
2. Strange hours of working hours for the fundraising staff in the United States
   Will a remote Dev push in 3 in the local time, claiming to be in Austin? This is not hustle – this time zone is inconsistent. DPRK operators often work from China or Russia and regulate their hours to avoid detection. Look for the strange explosions of the weekend activities or non-natural business traffickers.
3. Remote access tools and use of anonymous
   IP-KVM keys. Mouse automation tools. VPNS and anonymons remote desktop protocols. These are not just weird – they are DPRK staples. You see the instruments that do not comply with the tools that are declared or simulating the presence of user behavior.
4. An unusual communication tab
   The camera is always turned off. Slowly silent. No questions, there is no friction. In many organizations, it is seen as a plus. But, especially the tabs below critical roles, explain. DPRK operates play invisible. Those silence is often a signal. DPRK operates are trained to stay invisible. In some cases, this quiet, only separation – this is the cover. Several fake employees recently did not disappear because they are not disappeared, but because of the seizures of the facilities in international spots. When someone is dark, it can make the following calls on the discounted systems of your treachery-law enforcement agencies.
5. Examples of CVs permanently or referralr
   See your employer closer to your pipeline. Reused. Repeated expressions. Overlapping career times. These are signs of templates. DPRK operates often enter through fake employers or apply to other DPRK staff in their groups. When the candidates begin to interfere with each other, it was time to dig deeper.
6. Incompatibility between interview and performance in the work
   Crushed the interview. The first day fell straight. This is a problem when the person in the work does not suit the person who gives an interview. It was all used to slip through voice modifier, stands and images in deep skin. Even a quick pursuit of inconsistencies.

I hired a DPRK employee. What is now?

Step first: Don’t panic. Two steps: move quickly.

When sensitive customer information or intellectual property is exposed to, your answer should be immediate, coordinated and comprehensive.

Here’s what you need to do after that:

1. Immediate storage and isolation
   Stop all the entries immediately-vpns, cloud platforms, code reposes and e-mail. Protect them for quarantine devices and court analysis; Do not delete or reset anything. Reset all related credentials to prevent additional entrance. It is important to move fast here. Every minute is considered to prevent information theft or provocations.
2. Comprehensive Court Investigation
   Bring specialists with insider threats and DPRK tactics. Analyze the notes from networks, clouds, end points and code repositories to open unusual access or information expiltration. What did they touch? Where do information run? Search for hiding data transfers or activity to hide activity.
3. Assess the exposure area
   Have you accessed customer information, IP, source code or adjustable content? Appreciate the compatibility under GDPR, HIPAA or CCPA. Risk is not limited to the thinking of theft, ransomware or deeper compromise.
4. Coordinate the cross-functional response
   Bring legal, PR and HR. Legal tips on disclosure; Pr Preps messaging; HR manages the interior stream. If you coordinate faster, you make more control.
5. Deal with foreign authorities
   Including the loop in law enforcement agencies Internet Criminal Complaint Center (IC3) and Defense Department cyber crime center (DC3). These are not only corporate risks; are those who are geopolitical. Share the intelligence strengthens your position and can help prevent future violations.

Prevention of beyond Cyber ​​and HR

A recognized ICS is a good news that IOCS works and a clean report. But DPRK ops moves fast. Prevention requires behavioral viewing and intense team alignment.

Pretective protective measures:

• Live with IP / Geolocation Confirmation, conduct interviews with camera
• Check references and past employment independently
• Use undocumented, technical Q & A to measure the real expertise
• HR in security consciousness and recruitment processes are legally involved in legal

Post-rented protective measures:

• Re-apps using the flag repeated information or nickname
• Monitor unusual access time, remote tool and monitor for VPN spikes
• Track Level-Silence is a signal
• Follow the early signs that abuse the settlement or data abuse

Internal and external security, risk and legal groups, close cooperation between organizations, increasing and reducing organizations and reduction of organizations can establish a risk program. Prevention is the team’s efforts and behavior is the strongest signal.

North Korea – what is next

The latest and ongoing government actions have taken the attention of DPRK’s shadow work. However exposure is not eliminated. PlayBook will develop new names, new tools, new countries.

Modern insider will not always seem suspicious. They will look perfect. Until it disappears.

It’s a step to know what you are looking for. Closing it for good is the upcoming mission.

Reviews expressed in Fortune.com are the opinions of the authors and do not necessarily reflect the ideas and beliefs Fortune.

Read more: