Cyberangriffe: Nordkorea-Cybergruppe bestiehlt IT-Fachleute auf Jobsuche

German intelligence agencies are warning job-seeking IT professionals to be wary of a cyber group allegedly stealing cryptocurrency and sensitive data to fund North Korea's weapons program. The operatives, acting on behalf of the state, employ social engineering techniques to manipulate individuals into divulging confidential information or performing actions beneficial to the attacker.

The Federal Office for Protection of the Constitution and the Federal Intelligence Service (BND), in conjunction with security authorities in Japan, the United States, and Australia, have warned of a campaign known as "Contagious Interview." The group, referred to in the IT security community, begins by contacting software developers and other IT professionals seeking work through social media, job platforms, or freelance work websites.

They often pose as representatives of AI companies or cryptocurrency firms. During the supposed job application process, the candidate is assigned a task requiring the download of a file containing a malicious program. Once the attackers gain access to the victim's system, they steal sensitive data and cryptocurrency. These trojans maintain access to other systems belonging to the victim.

North Korea, meanwhile, is allegedly pursuing a different campaign, as indicated in October 2024. North Korean IT specialists use false identities to secure remote developer positions, also to secure payments and fund the North Korean state. To avoid detection, some workers utilize laptop farms, facilities in another country where computers are provided remotely accessible to the IT specialist.

Employers should be suspicious of candidates who invent excuses to avoid in-person meetings, request payment in cryptocurrency, or frequently look away during online interviews. North Korea's sanctions, due to its nuclear and missile programs, have been extensive for nearly two decades. China and Russia have blocked further punitive measures at the UN Security Council, preventing the extension of the mandate of a UN expert panel overseeing sanctions implementation.

The "Waterplum" group aims to fund the "salaries for the Kim regime and its military," but espionage and theft of intellectual property may also play a role in individual cases.