Troll, but Verify: Security Lessons from North Korean Job Candidates

Transcript

[Music] Well, good a good good afternoon everyone. Can you hear me? Okay, awesome. Very good. Uh, my name is Noid. I work for Kraken. And today I'm going to be talking about something you might find very interesting. How many people uh have firstirhand experience hiring North Korean IT workers? Anybody in the room? Okay. How many people sort of know what I'm talking about, but not really? Okay, there's probably a North Korean working at your company. So, by the end of this talk, um hopefully you'll learn what to do and what to look for. So, um I gave this talk, a version of this talk previously at ETH Denver. And so, I just

wanted to update everyone on uh what we actually did. So, the story so far, um North Korea has been trying a lots of different things, right? North Korea and crypto, they go hand in hand, right? It's the the buy bit. It's it's it's everything, right? Onchain exploits. Specifically for this talk, I'm focused on the IT workers, right? They um there's all sorts of different techniques that they use to try to earn money for the regime. Today, specifically, I want to narrow the focus on North Korean IT workers. And if you don't know what that is, that means people affiliated with the government of North Korea actually will apply to your company, apply as a contractor, apply as a full-time employee, and actually try

and get real jobs. And many of them do. They succeed. Some of it is just to earn money for the regime, but sometimes they put in exploits. They try to steal your data. There's extortion. Uh it's pretty wild. And so this is something that's not unique to the crypto industry, but is certainly a huge target because of our very unique culture. So to kind of catch you up to speed on what I'm talking about, Kraken recently did a huge uh promo blast about what we did. Um so I had the opportunity to speak with someone uh on Zoom from North Korea about five or six times uh two different people um because they actually applied to a role I was hiring for. So, uh, when we found out that they were from North

Korea, we thought there was an opportunity to have some fun. And so, that was in October of last year. And so, in February this year, I shared a little bit about of what happened at ETH Denver. Uh, I'm not going to rehash that totally, but you can watch it if you're interested to see what it actually looks like to get on a Zoom call with them. And so, uh, in May 2025, we did a big promotion hit where we had a blog, CBS did an interview because from us at Kraken, we want to get the word out that this is a real threat and that this could happen to you 100%. So, if you haven't seen our spot, uh, basically we we we did a little, uh, trolling. So, um, what we did is we, you know, had the

guys of some normal questions, right? We asked them typical dev questions, security questions, things like that. Uh, but what's really interesting about these North Korean candidates is they really kind of struggled around the small talk piece. And so, uh, we made a little viral clip on X about their questions, but basically we asked them questions that they have no idea what we're talking about. Like, what's your favorite barbecue place in Texas? They they can't even point to Texas on a map, right? So, they stumble and fumble. Um, and it's kind of amusing. And this question here was because we asked them what's his favorite Halloween movie. And so, you know, they were just not really aware of those traditions. And so, it made for a really fun viral little hit

to raise that awareness and sort of bring this to the forefront in people's minds that this is very real. Um, but I think some people maybe got the wrong idea, right? It's very fun to poke fun at, you know, oh, they're so silly, they're so backwards, their favorite movie is Frozen and the Minions, which is true. Um, but you know, uh, I I really want to dispel some myths of of what we have here, and that's why I want to talk today. Uh, a little bit about what we did. By the way, in addition to trolling them, we actually wanted to collect some intelligence. So, we actually gave them a fake hiring test that actually asked them to KYC on our platform. and uh they actually did um so they are able to actually do this work

and so that really helped us improve our fraud detection but also share those indicators with the rest of the community as far as what we saw how they do those things and by the way they will do pretty much whatever you ask them to. So, if you think it's a barrier to have them KYC, uh they will KYC, right? They will have people that can make passport documents. They often have mules, partners, stolen identities. Uh this one in particular, this is the real one they submitted. It's not great. You can see that there's um a lot of inconsistencies, right? As someone who looks at a lot of fraud and fake IDs a lot, there's a lot of things that stand out in terms of their name, how it's not aligned, it's a different font, things like that that sometimes might be caught

by automated systems, but it's just really interesting. I think that some people think that this is a huge barrier for North Korea IT workers that if you somehow ask them to submit KYC, they're able to do it. Um, so don't count on that being the only barrier to getting this. And so, uh, if you're not familiar with the crypto Twitter space, there's a ton of researchers on there who do amazing work. Uh, two of them listed here, uh, Tay and Narcast 3. Um, really impressive stuff. I think it's a crime that this only got 2,000 views. But someone was able to take that photo and identify uh, our person named Stephen Smith there waving a North Korean flag.

Now, if that's not uh something that you can tell management, you know, we probably should do something about this person if you actually hired them, it's a really convincing photo, I think, and is pretty interesting. And so, we have a bunch of amazing researchers in the space, and I wanted to shout them out here. I'll have a list of followers at the end, but you should just be aware of these things happening because, um, there's only so many North Koreans, right? And there's a ton of researchers. And so we got to share that information better so that you're aware of what that looks like because often they're getting multiple jobs, right? This Stephen Smith has probably applied to 10, 15, 20 different places in the crypto industry and beyond. So I thought that you would find that a little bit interesting. But

I want to dispel some myths uh after our spot. One of the first myths that I heard was that North Korean devs are dumb. They're they're not dumb. Okay, they're not bad devs. In fact, the number one piece of feedback from the people that do threat hunting around North Korea, the number one thing they say is they're pretty good devs. And that's the thing, right? They can do the job. It's like a consultant's dream, right? You have the entire network of your entire consulting company to ask a question. You might have an expert in IT. You might have an expert in Rust.

You might have an expert in solidity. You might have an expert with someone who does presentations. they have like this entire system and network of these specialists to do the tasks that are needed. And so even though it's fun to poke fun at them and make this go viral and raise that awareness, it is not uh the takeaway that I want you to have that they don't know what they're doing or they're silly or they're backwards. They are actually capable. And that's I think the issue that some people don't realize. Myth number two of what we have, background checks will stop this.

Um, a lot of people rely on background checks. I've spoken with a lot of people from HR departments who say, "Yeah, we would never hire an H we would never hire a North Korean operative because we have background checks." Well, that doesn't that that's not a real submission, by the way. It's just a a meme here. But the the point is that um when we actually uh we tested our background check vendor on this one and the documents that they submitted came back clean. And so if you're an HR department or you're just checking them out and say, "Oh yeah, we do a background check with XYZ vendor." Um often times they're getting stolen identities, they have mules, right?

They'll offer money to real citizens to say, "Let me borrow your passport." And they think that they're doing other things. So, don't count on that being a barrier to North Korean IT workers. I think that's really important to highlight here. I think a lot of people think that that will stop it. In in our case, it wouldn't have. And myth number three, um, you need to throw money at enterprise AI detection. And I think overall, uh, people in industries like this, I've seen this happen in the typical IT cyber communities. Um, oftentimes when there's a big problem that no one knows what to solve, these companies pop up and uh people will sign over lots of money to pay for a product that doesn't really work. Um, and I'm

talking specifically about deep fakes, right? Everyone thinks to hire a North Korean worker, they're going to be a deep fake. While it's true that they do use deep fakes sometimes, um, they don't always, right? It's not always a deep fake. And the problem that I've noticed, even if it is a deep fake, the deep fake detection software, I've tried pretty much all of them. So, I'm not going to name any vendor names, but as you can see here that uh it does it is easy to bypass, right? Um, you know, no AI detection thing is 100% accurate. And so, if you bought the latest and greatest tool for $200,000 a year that's supposed to detect deep fakes, I don't really think that's the way to go,

right? there's cat and mouse games that they play. They can play videos back. Um, you know, they can have other people doing these types of things and they don't always use deep fakes. So, I've kind of seen that bandied around as like the solution, but I just kind of want us to have a sober mind here and say, you know what, we don't need to throw money at that yet. Um, so just watch out. Um, so what can we actually do? How do we win as a community against this? Um, I don't want to just lay out these problems, right, and just say, "Yeah, you're going to hire North Koreans and there's nothing you can do about it."

That would be a bummer. Um, but here's how we win. Strategy number one, embed security into the recruiting process. I know that's really sounds kind of weird, right? But, uh, raising awareness from your recruiters and just saying, "Hey, watch this talk. Um, there are North Korean IT workers that will be reaching out, that will get on Zoom, that will pass the technical aptitude test. How do you handle that sort of thing? And so what we do at Kraken is we train uh all of our recruiters, all of our HR staff to be aware of this sort of thing. Um, we actually do red team campaigns as well. So, um, from the perspective of,

uh, the red team, if you're not familiar with what that is, we have an internal team that will actually test our own security controls. And so, our red team made fake LinkedIn profiles and actually took interviews with our team to see what they would do, if we can convince them to download things, share their screen. It's a really good exercise to do if you haven't thought about it, just to see if it's possible because it makes it real. It's no longer theoretical, right? They know how they felt. They know what they were doing. and they know what they can improve. If there's one thing that I can add, if you wanted to do this right now to double check, let's say you're a small team and you don't have like a super mature HR process, but you just want to get a gut check of

someone. Um, a really good way to do that is to actually search for breached data on the emails. Um, often, you know, a real person will have some data breaches out there on have I been pawned uh Intellect dehashed those are all really great sources. And so if you haven't checked your own email on that, first of all, do that like right now because probably people have seen what your old passwords used to be, things like that. But what I'm highlighting here is that as part of the HR process, um you should double check to see what breach records there are. Uh in this particular case for the people that we looked at there were multiple sources of data breaches which is normal for a person but it's very unusual for

them to be operating under maybe 10 different identities uh to have steeler logs working at 10 different companies uh under different identities. Right? So uh it was very clear here that um you know this was not tied to an individual. This was someone operating multiple identities in multiple places and that's just not really typical of a normal human here. So again the culture questions as well for HR the culture questions are big. I know it sounds silly and we have the crypto culture, but if you hire someone without talking to them, um I know it sounds dumb and fluffy to chat with people about, you know, what they like to do, but um it actually in this case, you would be able to sniff out pretty easily um you know,

whether or not they actually have ever been to the US, for example. So here's the second strategy on how we win. We need to have playbooks for this scenario, right? Everybody has a plan until they get punched in the mouth. And so what we like to do is at Kraken with the red team is we like to uh make sure that we're exercising our incident response protocols every once in a while. It's like a fire drill, right? You have the map and that's good to have the map, but you need to practice that to know where to go, who to talk to, and what to do for that. Many times uh we encounter people and I've heard things from other companies where um you know they've actually hired someone from North Korea and then they don't know

what to do. Um and so I'd encourage you to think about that and have a playbook in advance. You might never use it, but it's better to have it and not need it than to be stuck wondering what to do. For example, if someone tells you you're hiring a North Korean IT worker, you need to make sure they don't get paid anymore. Okay. Um, it's one thing if you don't know that you're paying them, but then if someone tells you and then you keep paying them, that's going to be a really big issue with the US Treasury Department. So, please don't forget to do that and make sure you have a plan to do that. If you don't know what I'm talking about, if you've never seen an incident response plan, the Security Alliance GitHub has some pretty cool starter frameworks of like what a good

incident response playbook, lessons learned, uh, communication strategies, welcoming contributions to things like that. If you don't have that already, it doesn't matter how big or small you are, it's really important to think about those sorts of things. And then how we win. Number three, we need to talk more openly as an industry. We've got to share information. And so a lot of times when this happens to companies, they're really reluctant to talk about it. And so I want to highlight a few things in the industry that I think were amazing responses. Um, you know, if something happens to you, you shouldn't try to hide it under the rug and say, "It never happened. It wasn't us." I understand legal feels weird about it and all that sort of things. Uh, but a really good response to highlight, I think, was uh,

from the Cosmos team, right, where they they had a blog out. I don't know if you've seen this, um, but they they identified that there were people that that were hired and, uh, they offered double bug bounty on anything that that person touched. I think that's a great response. It encourages people to look at it and it's not a culture of, you know, we need to be like super ashamed. We've got to share this because um, when you have this, someone else might be doing the same thing, right? They're the same people interviewing at multiple jobs. And the sooner we get that out to other people, the better. So what do I mean in a formal capacity, right? Other than following people on X and things, here's three sources that you can use right now. Doesn't matter if you're small, if

you're big. The first two on the top, those are called Isacs. That's an information sharing community. And basically what these do is they're made up of exchanges, other crypto companies that if you see an IT worker, we can pass on the name and say this was the email, this was the alias they used, this was the file they told me to download. And you know, by you submitting that and telling other people, you actually might save somebody else who's a little bit more proactive. So those are two good sources. Um, if you just want to check this out, right, you don't have the resources, you don't have a security team yet, um, there is a free resource. is called Alien Vault OTX. Um that's at the bottom and you can see that there's uh you can follow tags

and so anytime there's new things about IT workers, you can actually see the emails, the names, the things and then do a quick check of your HR system because they are persistent, right? They'll try again and try again and try again. Fun fact, after Kraken did our thing, it did not stop. They continued to try and reach out and get hired to various roles. So, it's clear that even though we made a viral meme of them, uh, they kept going. And so, if you're not familiar at all with what an ISAC is, this is what it looks like, right? Uh, people, various companies will publish emails, things like that. You still need to vet these, right? That doesn't mean you need to go vigilante on these, but the idea is that you have a list of

emails you can check and see. And the more that we share this information and the more we get this stuff out there, the better prepared we're going to be. So, uh, my talk is called troll but verify. And I think trolling in a non-culture is such an important part of the crypto space. We can't lose that part. It's good to be a non. It's good to have pseudonyms. That's the whole point of this space. But, you know, even though we do those sort of things, we still need to verify and mature as a group to build in those processes to make sure that we're actually stopping this really, really pertinent threat.

Um, I'm checking on time and we have three minutes left for questions. Thank you so much for your time and I'll take some questions. [Applause] Yeah. Good question. I almost put that as a slide. The insult Kim Jong-un strategy is hilarious. Uh there's lots of people that will testify that it works. My concern is that they'll change their tactics, right? They're like literally working directly with the top dogs. So, um you know, I think it will work for a time, but then eventually they'll get a waiver that says it's okay. You can talk trash about him. You can say he's fat,

ugly, whatever. So, I think it's funny. It's a meme. works now, but I wouldn't put all my, you know, I I I wouldn't say that this is the enterprise ready thing 10 years in the future. You know what I mean? Good question. Yeah. Sorry. Okay. Hey, um, really interesting talk. I'm wondering like what tipped you first off that you knew they were North Korean spies so you started trolling them and already had like your high alerts up before you like got out their QAC and could really prove that they are North Korean spies. Yeah, 100%. We really wanted to make sure that we vet that right before we do this because imagine

if it was a real person and we just like yeah Kraken has a terrible interview process. They just asked about food all day. Um, no, we did get a tip from those information sharing communities. And so that's kind of sort of my pitch to the community is like we need to get more involved in sharing those things. But because we had those actionable tips vetted, um, you know, often they come from like trusted sources. So that's how we got the tip and that's how we felt comfortable enough to engage the trolling. Thank you. Good question. Time for one more. awkward silence.

Um, awesome. Well, thank you so much everyone today. I hope you learned something. Oh, wait. I got Sorry, my contact. Uh, don't get in the habit of scanning QR codes at conferences, by the way. Um, but if you do want to chat more about this, I have all the links on my portrait site, portrait.so/noid. Uh there's a fun surprise if you scan the QR code, just so you know. So, some of you may have got it already, so just be careful. Um but if you want to reach out to me, please let me know. Um and if you do see something suspicious, please say something. I'll get it to the right people. Thank you so much, everyone.