CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

AI-Generated Fake Employees Exploit Remote Work to Gain Access to Corporate Networks

First reported
Last updated
📰 2 unique sources, 4 articles

Summary

Hide ▲

AI-generated fake employees are increasingly infiltrating corporate networks, exploiting remote work and gig economy trends. These fake employees, often backed by state-sponsored actors, gain privileged access to steal intellectual property and virtual currency. The issue is exacerbated by the ease of falsifying documents and conducting virtual interviews using AI. North Korean actors have been particularly active, using fake identities to secure jobs in various sectors, including blockchain research and development. The Justice Department has shut down several laptop farms facilitating these activities, but the problem persists. The U.S. Treasury Department has also sanctioned individuals and entities involved in these schemes, revealing significant financial transfers and profits. Organizations need to implement multi-layered security measures, including access governance, behavioral analytics, and AI-driven monitoring, to mitigate this risk. The scheme has expanded to Europe and deepened its networks in the Asia Pacific, with operatives claiming residency in Japan, Malaysia, Singapore, and Vietnam. The Japanese government has warned companies to verify identities and requested freelance-platform providers to reinforce anti-fraud efforts. The U.S. Treasury Department has sanctioned additional entities for their roles in the IT worker scheme, accusing them of generating revenue for the Democratic People's Republic of Korea (DPRK). The threat of remote hiring fraud is escalating rapidly, with a 220% increase in cases year-over-year. North Korean operatives have used AI-generated profiles, deepfakes, and real-time AI manipulation to pass interviews and vetting protocols. American accomplices have operated laptop farms to provide physical US setups, company-issued machines, and domestic addresses and identities. The scheme targets Fortune 500 companies, indicating a systematic and organized campaign. To mitigate this risk, organizations should consider implementing zero standing privileges (ZSP) to ensure minimum access required to function and revoke access when the task is complete.

Timeline

  1. 08.09.2025 12:20 📰 1 articles · ⏱ 8d ago

    Zero Standing Privileges Framework to Mitigate Fake Hire Risks

    Zero standing privileges (ZSP) is a security framework that can help mitigate the risk of fake hires by ensuring minimum access required to function and revoking access when the task is complete. A practical way to begin implementing ZSP is by piloting it on the most sensitive system for two weeks to measure access requests, approvals, and audits. BeyondTrust Entitle is a cloud access management solution that enables a ZSP approach, providing automated controls that keep every identity at the minimum level of privilege.

    Show sources
    Open in new tab
  2. 04.09.2025 04:00 📰 1 articles · ⏱ 12d ago

    North Korean IT Worker Scheme Expands to Asia Pacific

    North Korean operatives have expanded operations to Europe and deepened their networks in the Asia Pacific, claiming residency in Japan, Malaysia, Singapore, and Vietnam. The scheme has collected more than $88 million over six years. The Japanese government has warned companies to verify identities and requested freelance-platform providers to reinforce anti-fraud efforts. The U.S. Treasury Department has sanctioned additional entities for their roles in the IT worker scheme, accusing them of generating revenue for the Democratic People's Republic of Korea (DPRK).

    Show sources
    Open in new tab
  3. 28.08.2025 11:53 📰 2 articles · ⏱ 19d ago

    U.S. Treasury Sanctions North Korean IT Worker Scheme

    The U.S. Treasury Department has sanctioned Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology, and Korea Sinjin Trading Corp for their roles in the IT worker scheme. The two individuals and two companies allegedly acted as fronts for the North Korean government to facilitate the transfer of at least $1.6 million to the regime. The Japanese government has warned companies to verify identities and requested freelance-platform providers to reinforce anti-fraud efforts.

    Show sources
    Open in new tab
  4. 21.08.2025 00:39 📰 4 articles · ⏱ 26d ago

    North Korean Actors Exploit Fake Employee Identities to Steal Virtual Currency

    North Korean operatives have used AI-generated profiles, deepfakes, and real-time AI manipulation to pass interviews and vetting protocols. The scheme has seen a 220% increase in cases year-over-year, indicating rapid escalation. American accomplices have operated laptop farms to provide North Korean operatives with physical US setups, company-issued machines, and domestic addresses and identities. The scheme targets Fortune 500 companies, indicating a systematic and organized campaign.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

UNC6040 and UNC6395 Target Salesforce Platforms in Data Theft Campaigns

The FBI has issued an alert about two cybercriminal groups, UNC6040 and UNC6395, targeting Salesforce platforms for data theft and extortion. UNC6395 exploited compromised OAuth tokens for the Salesloft Drift application, while UNC6040 used vishing campaigns and modified Salesforce tools to breach Salesforce instances. Both groups have been active since at least October 2024, impacting multiple organizations. UNC6040 has been linked to extortion activities, with Google attributing these to a separate cluster, UNC6240, which has claimed to be the ShinyHunters group. The ShinyHunters group, along with Scattered Spider and LAPSUS$, recently announced they are going dark, but experts warn that the threat persists. UNC6040 impersonated corporate IT support personnel to gain access to Salesforce environments and used modified versions of Salesforce's Data Loader to exfiltrate data. Salesforce re-enabled integrations with Salesloft technologies, except for the Drift app, which remains disabled.

Open in new tab

U.S. sanctions Southeast Asian cyber scam operations stealing billions from Americans

The U.S. Department of the Treasury has imposed sanctions on several large cyber scam networks in Southeast Asia, particularly in Burma and Cambodia. These operations, which stole over $10 billion from Americans in 2024, are known for using forced labor, human trafficking, and physical violence. The scams include 'romance baiting' and fake cryptocurrency investment schemes. The financial damage to Americans increased by 66% compared to the previous year. The sanctions target 19 entities and individuals linked to the Karen National Army (KNA) in Burma and various organized crime networks in Cambodia. These entities are involved in running scam centers, providing infrastructure, and facilitating money laundering. The sanctions block these entities from the U.S. financial system, freeze their U.S. assets, and limit their access to international financial services. The cybercriminal syndicates in Southeast Asia are estimated to net nearly $40 billion annually in illicit profits. In May 2025, OFAC targeted Funnull Technology Inc. and its administrator Liu Lizhi for their part in romance scams that caused more than $200 million in losses. In July 2025, Cambodian law enforcement raided several cyber-scam centers, arresting more than 1,000 people. The cybercriminal operations have led to the growth of entire cities along national borders, especially in conflict zones and special economic zones (SEZs).

Open in new tab

Texas Sues PowerSchool Over Breach Exposing 62M Students

Texas Attorney General Ken Paxton has filed a lawsuit against PowerSchool, a cloud-based education software provider, after a December 2024 data breach exposed the personal information of 62 million students and 9.5 million teachers worldwide, including 880,000 Texans. The breach involved stolen credentials and a ransom demand of $2.85 million in Bitcoin. The lawsuit alleges violations of the Texas Deceptive Trade Practices Act and the Identity Theft Enforcement and Protection Act. The breach occurred when an attacker exploited a subcontractor's stolen credentials to access PowerSchool's PowerSource customer support portal. The stolen data included names, addresses, phone numbers, passwords, parent information, contact details, Social Security numbers, and medical data. The attacker initially demanded a ransom but later attempted to extort individual school districts, claiming to be part of the ShinyHunters group. The lawsuit aims to hold PowerSchool accountable for failing to protect sensitive information and misleading customers about its security practices.

Open in new tab

GhostRedirector Campaign Targets Windows Servers with Rungan and Gamshen

A threat cluster named GhostRedirector has compromised at least 65 Windows servers in Brazil, Thailand, and Vietnam. The attacks deployed a passive C++ backdoor called Rungan and an IIS module named Gamshen. The threat actor has been active since at least August 2024. The primary goal of the attacks is to manipulate search engine results to boost the ranking of specific websites, including gambling sites. The campaign targets various sectors, including education, healthcare, insurance, transportation, technology, and retail. Initial access is gained through an SQL injection vulnerability, followed by the use of PowerShell to deliver additional tools. The threat actor is assessed with medium confidence to be China-aligned.

Open in new tab

Wytec website defacement disrupts operations and causes financial loss

Wytec International, Inc., a Texas-based communications and safety solutions provider, experienced a website defacement attack on August 25, 2025. The attackers defaced the website twice, forcing Wytec to take it offline for a security review and implementation of additional security measures. The incident resulted in significant financial losses, including the cancellation of a scheduled seminar. The FBI and forensic specialists are investigating the incident. The company provides solutions for gunshot detection, drug sensing, and indoor cellular services, serving the education, healthcare, and government sectors. The attackers' motives and identities remain unknown.

Open in new tab