The Threat Of DPRK IT Workers: A Deep Dive Into Their Tactics And Techniques

The threat of DPRK IT workers is well documented. Nisos published a report detailing a network of likely North Korean (DPRK)-affiliated IT workers posing as Vietnamese, Japanese, and Singaporean nationals to obtain employment in remote engineering and full-stack blockchain developer positions in Japan and the United States. This campaign uniquely utilizes GitHub to create new personas while reusing established GitHub accounts and portfolio content from older personas to support their new identities.

Key Takeaways:

Personas claim to have experience in three areas: developing web and mobile applications, knowledge of multiple programming languages, and an understanding of blockchain technology.
Personas have accounts on employment and people information websites, IT industry-specific freelance contracting platforms, software development tools and platforms, and common messaging applications, but they typically lack social media accounts, suggesting that the personas are created solely for the purpose of acquiring employment.
Profile photos are digitally manipulated. Often the DPRK-affiliated IT worker’s face is pasted on top of a stock photo to show the individual working with colleagues.
Personas within the network use similar email addresses.
Email addresses often include the same numbers, such as 116, and the word “dev”.

You Should Know:

1. GitHub Account Analysis:

Use the following command to clone a GitHub repository for analysis:
```
git clone https://github.com/username/repository.git
```
To check the commit history for suspicious activity:
```
git log
```

2. Email Address Analysis:

Use `grep` to search for specific patterns in email addresses within a file:
```
grep -E '116|dev' email_list.txt
```

3. Image Forensics:

Use `exiftool` to analyze metadata of profile pictures:
```
exiftool profile_picture.jpg
```

To detect image manipulation, use foremost:

foremost -i profile_picture.jpg -o output_directory

4. Network Traffic Analysis:

Use `tcpdump` to capture network traffic:
```
tcpdump -i eth0 -w capture.pcap
```
Analyze the captured traffic with Wireshark:
```
wireshark capture.pcap
```

5. Blockchain Analysis:

Use `geth` to interact with the Ethereum blockchain:
```
geth attach http://localhost:8545
```

To check transaction history:

eth.getBlock(blockNumber, true).transactions

What Undercode Say:

The tactics employed by DPRK-affiliated IT workers are sophisticated and require a multi-faceted approach to detect and mitigate. By leveraging tools like GitHub, email pattern analysis, image forensics, and network traffic analysis, security professionals can uncover these malicious actors. Additionally, understanding blockchain technology and its associated tools is crucial in identifying fraudulent activities within this domain. Always stay vigilant and continuously update your knowledge and tools to combat evolving threats.