The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →KnowBe4 says a person using a stolen U.S. identity passed its standard hiring checks for a remote software engineering job in July 2024. The company says endpoint security tools flagged suspicious activity after it issued the worker a computer, and that no customer data was accessed or lost. KnowBe4 later said more than a dozen other organizations had contacted it about North Korean workers they had hired or applicants they had received. That number is a company-reported account, not a measure of how common the scheme is.
How did a North Korean hacker get hired by a security company?
According to KnowBe4’s incident account, the company hired a principal software engineer for its internal IT AI team after interviews, standard background checks and reference checks. The person used a real person’s stolen U.S.-based identity and an AI-enhanced image.
KnowBe4 says it issued the new hire a company workstation. On July 15, 2024, its endpoint detection and response (EDR) system flagged suspicious account activity and alerted the security operations center. The company described activity that included manipulating session-history files, transferring potentially harmful files and running unauthorized software. It said a Raspberry Pi was used to download malware.
KnowBe4 says it contained the device at about 10:20 p.m. Eastern, roughly 25 minutes after the first alert. It shared evidence with Mandiant and the FBI. The company noted that details were limited while the FBI investigation was active, so its public account does not resolve every investigative question.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWas KnowBe4 hacked, and was customer data affected?
KnowBe4 said no customer data was accessed and no data was lost, compromised or exfiltrated. That is the company’s account of the incident; it should not be mistaken for a broader finding about every possible investigative detail.
#1 Best Overall
- The 2024 Employee Food Safety Handbook provides a convenient employee handbook of 13 critical food safety issues. This NEW 5th edition features a chapter on training.
- Critical food safety topics include: Foodborne Illness, Personal Hygiene, Hazard Analysis & Critical Control Points (HACCP), The Food Safety Modernization Act and Prevention, Sanitation, Time & Temperature Controls, Foreign Material, Cross Contamination, Allergens, Pest Control, Security, and Training.
- Quizzes. Essential food safety guidebook has chapter review quizzes to aid employee retention while reinforcing key food safety issues. Answer key included.
- Featuring an easy-to-read format, full-color photographs, bulleted lists, charts, and chapter quizzes.
- Specifications: 5 1/4” x 7 1/4" Handbook, English. Fifth Edition. Copyright 2024. Made in the USA.
The incident shows a distinction that matters to employers: a person can pass ordinary hiring checks and still trigger security alerts once given a company device or access. KnowBe4 CEO Stu Sjouwerman summarized the concern in the incident account: “If it can happen to us, it can happen to almost anyone.”
Why KnowBe4 said the hiring incident was not unique
In a September 2024 white paper, KnowBe4 said that within weeks of its July disclosure, more than a dozen organizations told the company they had hired North Korean workers or received applications from them. It said those organizations ranged from Fortune 500 companies to small businesses. Dark Reading also reported KnowBe4’s account of those contacts.
Rank #2
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
This is evidence that other organizations reported similar hiring concerns to KnowBe4, not a representative survey or verified count of affected employers. KnowBe4’s white paper describes an operation involving North Korean-based leaders, workers and managers abroad, local facilitators, and supporting infrastructure for identities, references, websites, payments and money laundering. It characterizes many workers as skilled IT developers living outside North Korea, including in China. Those details are the company’s description of the operation, not independently established facts about every suspected case.
How employers can reduce the risk of a fake remote IT worker
The FBI’s 2024 guidance and its January 2025 update point to controls across hiring, access and monitoring. Identity checks are important, but they should be part of a lifecycle process rather than a one-time hurdle.
Verify identity throughout employment
- Check remote workers’ identification information and follow up on errors through reliable verification methods.
- Cross-check applicant records and review whether contact details are reused across applicants or records.
- Reconfirm identity during interviewing, onboarding and employment, and complete as much of the process in person as practical.
- Train HR teams and hiring managers to recognize warning signs and escalate inconsistencies.
Limit new-hire access
- Apply least privilege: provide only the systems, data and permissions the person needs for the assigned work.
- Review access as job duties change, rather than allowing early permissions to become permanent by default.
Monitor devices and accounts
- Evaluate activity on a suspected worker’s assigned device and preserve relevant evidence.
- Watch for unusual network traffic, logins, remote connections, browser sessions and activity in code repositories.
- Use endpoint monitoring to alert security teams to suspicious actions, then ensure there is a clear process to assess and contain alerts.
Oversee staffing firms and payment changes
- Confirm that staffing firms use robust hiring and identity-verification practices, and audit those practices.
- Pay attention to changes in a worker’s address or payment platform and investigate inconsistencies through reliable channels.
What should a company do if it suspects a fake employee?
- Preserve and evaluate evidence. Follow the FBI’s advice to evaluate activity on the assigned device and relevant network activity. Preserve relevant logs and records as part of the organization’s incident-response process.
- Report promptly to IC3. The FBI recommends reporting suspected North Korean IT worker schemes to the Internet Crime Complaint Center (IC3), including in its 2024 guidance and January 2025 update.
- Use established security and investigation channels. Route the concern to the organization’s security and incident-response leads, and coordinate with appropriate authorities. The guidance supports reporting and evidence preservation; it is not a reason to make unsupported public accusations or conduct a risky confrontation.
The FBI’s January 2025 update also warns that some workers have used company network access for data theft and extortion. That warning makes monitoring and access controls relevant even when an employer’s initial concern is identity fraud.
Quick Recap
Best Value
- The 2024 Employee Food Safety Handbook provides a convenient employee handbook of 13 critical food safety issues. This NEW 5th edition features a chapter on training.
- Critical food safety topics include: Foodborne Illness, Personal Hygiene, Hazard Analysis & Critical Control Points (HACCP), The Food Safety Modernization Act and Prevention, Sanitation, Time & Temperature Controls, Foreign Material, Cross Contamination, Allergens, Pest Control, Security, and Training.
- Quizzes. Essential food safety guidebook has chapter review quizzes to aid employee retention while reinforcing key food safety issues. Answer key included.
- Featuring an easy-to-read format, full-color photographs, bulleted lists, charts, and chapter quizzes.
- Specifications: 5 1/4” x 7 1/4" Handbook, Spanish. Fifth Edition. Copyright 2024. Made in the USA.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
