North Korean hackers have been responsible for approximately 50% of cyberattacks targeting the U.S. tech industry over the past 12 months, according to CrowdStrike. The threat actors pose as remote IT workers and recruiters to infiltrate companies across the U.S., Europe, and Asia.
CrowdStrike's findings reveal a sustained campaign by North Korean threat actors exploiting the remote work environment. The attackers impersonate legitimate IT professionals and recruitment specialists to gain initial access to corporate networks, using social engineering as their primary entry vector.
This tactic allows adversaries to bypass traditional security measures by establishing trust before attempting network intrusion. Once inside a system, they can move laterally to access sensitive data or deploy malware.
The scope of North Korean cyber operations extends globally, with organizations in multiple regions affected. U.S. technology companies represent the primary targets, reflecting North Korea's interest in acquiring intellectual property and maintaining operational capabilities amid international sanctions.
CrowdStrike's assessment underscores the persistent threat posed by state-sponsored North Korean actors. Previous campaigns have targeted cryptocurrency exchanges, financial institutions, and defense contractors. The use of social engineering tactics represents an evolution in their approach, relying on human psychology rather than purely technical exploits.
Security experts recommend enhanced vetting procedures for new hires and contractors, particularly those with remote access privileges. Organizations should implement multi-factor authentication, conduct regular security awareness training, and monitor for suspicious account activity.
The findings highlight growing tensions in the cyber domain, with nation-state actors increasingly targeting private sector infrastructure. As remote work remains commonplace, the threat surface expands for companies unable to thoroughly verify employee and contractor identities before granting network access.
CrowdStrike's data reinforces the need for heightened vigilance across the tech industry and calls attention to the coordinated nature of North Korean cyber operations.
Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.
Two security researchers purchased commonly-used generic email domains and discovered hundreds of companies automatically sending sensitive corporate data to their listening services. The experiment reveals a widespread failure in email configuration practices across organizations.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.