Per the notice below, the New York State Department of Financial Services (DFS) has issued a cybersecurity alert to all its regulated entities about the use of remote technology workers.

Industry Letter

Date: November 1, 2024

To: All DFS-Regulated Entities

Re: Cybersecurity Advisory – Threats Posed by Remote Technology Workers with Ties to Democratic People’s Republic of Korea

The New York State Department of Financial Services (“DFS”) cautions all regulated entities to be aware of applicants for remote technology-related positions as there has recently been an increase in reports of threats originating from the Democratic People’s Republic of Korea (“North Korea”).  Regulators and law enforcement have identified repeated attempts by threat actors seeking remote Information Technology (“IT”) jobs at U.S. companies to access company systems and illicitly generate revenue for North Korea.  This advisory provides background information about common methods used by these threat actors, how to identify applicants and employees that may have ties to a foreign threat actor, and recommended steps companies should take to protect against this threat.

Background

IT workers operating on behalf of North Korea have used various tactics to attempt to obtain employment with U.S. companies.  The applicants often pose as individuals from the U.S. and other countries, using false and stolen identities and proxy accounts that belong to U.S.-based individuals, some of whom may knowingly sell their identities, assist with account creation and maintenance, and participate in pre-employment drug screening tests.  North Korean threat actors often use virtual private networks (“VPNs”) to appear as though they originate from and reside in U.S.-based locations when applying for telework positions.  Applicants involved in this scheme may ask companies to ship devices to an alternative location just prior to commencing employment, where the device may be accessed by a U.S.-based co-conspirator.  They may also decline to participate in any in-person or video conferences, opting instead to communicate via messaging or phone.  In addition, they often download remote access protocols to allow threat actors from overseas to remotely access the work device and ultimately the targeted systems.  North Korean workers have been known to use native tools on systems to blend in with normal computer and network activity in an attempt to avoid detection.  Advisories regarding these threats have been issued by the Federal Bureau of Investigation and the United States Department of State.  More information on these threats and recommended best practices for employers issued by those agencies is available here and here.

Steps to Protect Information Systems from Foreign Threat Actors

DFS urges companies to take the following steps to exercise diligence to protect information systems and nonpublic information.

Raise awareness with senior executives, information security personnel, and human resources.  Companies should disseminate information about this threat to senior executives, hiring managers, cybersecurity personnel, and Third-Party Service Providers (“TPSPs”).  They should assess whether certain personnel would benefit from a targeted training about this threat.  In addition, companies that use staffing agencies or hiring platforms should confirm that these TPSPs are aware of this threat, and that the TPSPs implement cybersecurity best practices when vetting applicants on their behalf.

Conduct due diligence during the hiring process.  Companies should conduct stringent background checks and identity verification procedures during the hiring process.  For example, companies should require more than just one official government document to verify identity, such as passports and national IDs; scrutinize social media accounts carefully; confirm applicants’ physical and IP address locations; and detect VPN and proxy server usage at all times, but especially during the interview process.  Verification of employment references is key to knowing an employee’s true identity and should be conducted thoroughly and with great care.  In addition, companies should assess whether to require live interviews or video interviews with cameras on to provide a clear view of the applicant and their background.  During or following the interview, employers should also confirm that the pictures from the applicant’s identification documents match the person on camera.  Companies should also review applicants’ phone numbers for the use of Voice over Internet Protocol (“VOIP”) numbers.

Implement technical and monitoring controls.  Companies should assess their own risks related to applicants and insider threats and should implement appropriate measures to mitigate these risks.  Examples of technical controls that companies should consider include tracking and geolocating corporate laptops and cellphones to ensure they are delivered and remain at the initially reported residence.  Companies should also immediately flag as suspicious any change of address, use of mail forwarding, or atypical working patterns.  In addition, companies should monitor for and restrict suspicious IP address locations, unusual network traffic, and any unapproved use of all remote access tools.  Depending on the organization’s risk profile, organizations should also consider engaging a cybersecurity vendor that specializes in detecting and monitoring potential threats, including but not limited to those linked to North Korea.

Proceed cautiously with all remote technology employees.  Companies should strictly limit remote employees’ access to systems and data necessary to perform their jobs.  Access levels may gradually increase over time when necessary to accommodate employees’ expanded role.  In addition, companies should assess whether to restrict employees’ ability to use and install remote access tools, as these can permit backdoors into or direct access to companies’ networks.  Companies should also enhance monitoring of remote workers’ internet activity, including visits to any overseas or otherwise unnecessary websites.

Notify law enforcement and regulators.  If a company suspects that they may be a victim of a remote worker scheme or have been approached by a fraudulent IT worker, the company should investigate and report to the FBI’s Internet Crime Complaint Center (“IC3”) at www.IC3.gov immediately.  In addition, companies should confirm that they are fulfilling reporting obligations to DFS under 23 NYCRR § 500.17, as well as reporting obligations under other state or federal laws.