As cited
Copy frozen at (site build).
threat intel
Proactively Defending Financial Institutions Against North Korean Remote IT Workers
Silent Push released a report on North Korean remote IT worker schemes where operatives use stolen or borrowed Western identities to obtain employment at U.S. and international companies, with salaries funneled back through cryptocurrency and payment processors. The scheme bypasses document-based know-your-customer (KYC) and anti-money laundering (AML) checks because the identity documents are legitimate and the connection originates from a clean domestic residential IP address, masking the upstream operator behind proxies or keyboard-video-mouse relays. Financial institutions can detect these schemes before onboarding by examining connection origin data, flagging early requests to move salary to alternative payment services, training recruiters on employment anomalies, and establishing clear handoffs between HR and cybersecurity teams.
Why it matters: Financial services hiring teams and fraud prevention groups must identify these operatives to prevent sanctions violations, money laundering, and unauthorized access to financial systems; the Department of Justice found North Korean workers had infiltrated over 100 U.S. companies as of June 2025.
- Source published
- First seen by Cybersecurity Tracker