USA 
United Kingdom
North Koreans using fake profiles to get tech jobs has become commonplace on recruitment platforms, but there are tell-tale signs you can look for to spot them, say experts.
The DOJ (Department of Justice) has said that over the past couple of years, the North Koreans have quietly made their way into Fortune 500 companies, potentially putting US national security at risk.
It’s now gotten to a point where some experts say that it's hard to find a major company that the North Koreans have not targeted.
How recruiters can spot North Korean fake candidates
A report on CNN saw interviews with leading experts from cybersecurity firms and reviewed dozens of open source data sets from North Korean computers to understand how the North Korean IT workers operate.
Looking at the profile of someone claiming to be Joe Paul, there were a number of hints that he might be a North Korean agent.
“There are a couple of things that immediately set us off, said CNN producer Teele Rebane. “The generic Western name, the cheesy cover photo, previous work experience at Walmart or the National University of Singapore.”
“These are all common experiences that the North Koreans claim to have had when we ran this profile photo through AI detection software, it quickly came up as AI generated. In some cases, the whole photo isn't AI generated, but the face has been swept from a new one.”
Experts are able to match exact profiles to datasets that they believe originate from the computers of North Korean operatives.
They include everything from their online search histories to the applications that they've downloaded, providing an insight into how the North Koreans operate the scheme.
Among the giveaways are use of VPN services, particularly from China, where many of the North Korean ‘candidates’ are based; evidence of downloading remote working software so that they can access their work computers; and looking at dozens of job postings, while scheduling multiple interviews.
“When you line up all of the digital breadcrumbs, the AI face swap, the remote access software, the English Korean translations, researchers say that the pattern is clear,” said Rebane.
Tracking typical online behaviors
Examining another profile, of Elies Alma Cortijo Mans, researchers were able to track online behaviours to determine his authenticity.
“There are a couple of hints that “Elias” might not be the Spanish developer that he claims to be.
“Astra weekend is a popular VPN service in China, where the North Koreans often base themselves. And we also see him downloading remote working software that allows the North Koreans to remotely access their work computers, which are hosted by facilitators in the US.
“Next, we see him looking up dozens of job postings, and his calendar appears to be packed with job interview invites from companies all around the world.
“He's also looked up and used AI Facebook on multiple occasions, which explains a profile photo that we saw earlier. And finally, there's Google Translate searches that show him translating email correspondence and job tasks from English to Korean.
“The man claiming to be Elies Alma Cortijo Mans is likely to actually be a North Korean IT worker.”
