A company has been hacked after accidentally hiring a North Korean cyber criminal as a remote IT worker.
The unidentified firm hired the technician after he faked his employment history and personal details.
Once given access to the company’s computer network, the hacker downloaded sensitive company data and sent a ransom demand.
The firm which is based in the UK, US or Australia did not want to be named.
It has allowed cyber responders from SecureWorks to report the hack to spread awareness and warn others.
It is the latest in a string of cases of western remote workers being unmasked as North Koreans.
Secureworks said the IT worker, thought to be a man, was hired in the summer as a contractor.
He used the firm’s remote working tools to log into the corporate network.
He then secretly downloaded as much company data as possible as soon as he had gained access to internal systems.
He worked for the firm for four months collecting a salary.
Researchers say this was likely redirected to North Korea in a complex laundering process to evade Western sanctions on the country.
After the company sacked him for poor performance, it received ransom emails containing some of the stolen data and a demand to be paid a six-figure sum in cryptocurrency.
If the company did not pay, the hacker said they would publish or sell the stolen information online.
The firm did not disclose whether the ransom was paid.
Firms duped
Since 2022, authorities and cyber defenders have warned about the rise of secret North Korean workers infiltrating Western companies.
The US and South Korea accused North Korea of tasking thousands of staff to take on multiple well-paid Western roles remotely to earn money for the regime and avoid sanctions.
In September cyber security company Mandiant said dozens of Fortune 100 companies have been found to have accidentally hired North Koreans.
But secret IT workers turning on their employers with cyber attacks is rare, according to Rafe Pilling, Director of Threat Intelligence at Secureworks.
"This is a serious escalation of the risk from fraudulent North Korean IT worker schemes," he said.
"No longer are they just after a steady pay check, they are looking for higher sums, more quickly, through data theft and extortion, from inside the company defences?"
The case comes after another North Korean IT worker was caught attempting to hack their employer in July.
The IT worker was hired by the cyber company KnowBe4, which quickly disabled access to their systems when it noticed strange behaviour.
"We posted the job, received resumes, conducted interviews, performed background checks, verified references, and hired the person," the firm wrote in a blog post.
"We sent them their Mac workstation and the moment it was received, it immediately started to load malware (malicious software)."
Authorities are warning employers to be vigilant about new hires if they are fully remote.
Latest Stories
-
Benlord pleads not guilty to charges before High Court
21 mins -
Nigerian detained by court over wristwatch fraud
36 mins -
Sparks fly as Kamala Harris does first-ever Fox interview
45 mins -
The creative arts are key to economic growth -Bawumia calls for strategic support
3 hours -
Bawumia announces November launch of local streaming platform to revolutionise royalties for creatives
3 hours -
Supreme Court dismisses certiorari application against KATH
4 hours -
Firm hacked after accidentally hiring North Korean cyber criminal
4 hours -
How does WhatsApp make money? It’s free – with some tricks
5 hours -
Businessman granted GH¢2m bail over fraud
5 hours -
Italy bans couples from travelling abroad for surrogacy
5 hours -
We must find ways to counter misinformation in the cyberspace – Peace Council
6 hours -
Hoax bomb threats spark panic for Indian airlines
6 hours -
Father arrested for brutal assault on daughter, 20, in Central Region
6 hours -
Niger drops French place names to honour local heroes
6 hours -
Ex-ANC spokesperson charged with fraud
6 hours