Exposing North Korea - The Hidden Cyber Army You Never Saw Coming

Hello and welcome. I am Boaz Fischer, founder of the Australian Institute of Insider Threat, and thanks for joining us. Most people see North Korea as an isolated and cut off from the world, sometimes referred to as a hermit world. But behind the image is a hidden cyber operation, one that's quietly infiltrating global companies stealing data and funding regimes. Today, we're speaking with Michael Barnhart, author of a powerful new Detex report exposing DPRK cyber syndicate and hidden IT workforce. It reveals how North Korea's cyber operations are disguising themselves as remote IT workers and slipping into trusted networks. They look like regular contractors, but they're not. How do they get tied? What happens once inside? Is this already happening in Australia? So to find out, let's ask Michael directly. But before we do that, Michael, could you tell us a little bit about your background and what drew you into this space? And secondly, what exactly is North Korea doing in the world of cyber operations that most people have no idea?

Thanks. Yeah, my name is Michael Barnhart. I also go by Barney. But yeah, I've been doing this for the past 20 years now, doing some way, shape, or form intelligence collection. I started off in the Army and regular, regular and special operations doing human intelligence, switched over from that to cyber, to signals intelligence. And then afterwards, I started moving through kind of the, the intelligence community and government spaces with under the cyber umbrella. One of the things that really stuck out to us on the North Korea front though, was the fact that, you know, you had good information on these other adversarial nations. North Korea was always that black hole. And I'm an Iran counterterrorist guy. I do these things, but I wasn't really needed. Okay. I'd rather focus on the intelligence gap. And no one was really paying attention to North Korea. So me and a group of guys, like-minded individuals, we really wanted to take the fight to North Korea and really kind of shake that out. Started working that mission set and then took my friends and some of our our assets over to Mandiant, and we started building out that North Korea program and the programs as a whole. So that's kind of what got us into the market. North Korea, though, if we're really kind of— and one thing we really highlighted in the report, too, is that you have your China, Russia, Iran hats on, and you try to create, you know, go about the problems the same way with North Korea, and it just won't work. These guys, it's not a government organization. It is a criminal enterprise. And the entire model that you would see in other nation-states are flipped To include America and the US. We get top-down funding. North Korea starts at the bottom, criminal elements, crypto heists, IT workers, and the money flows up. And everything is very hybrid and very criminal-like. And I think that's one of the, one of the bigger takeaways for North Korea as a whole.

Cool, cool, cool. So, so basically, just to sum up, you basically look at those 4 organizations and not much intelligence or information is really focused on North Korea. What has it been like, the journey of trying to gather this information? Because they're quite hidden.

Absolutely. And it goes not just for the IT worker efforts, but also the cyber efforts too. Everything about North Korea is a black hole. And so, you know, and by design, you know, that's not helped them in the past being disconnected from the world. But as we're more technologically advanced, And they are too, and more interconnected in the world. Kim Jong-un is a millennial. You know, whenever he brought in, he brought in all that technical prowess and wanted to really steer and lean into that. And so that's, that's, that's kind of the shift there. But, but tracking them, I think a lot of it has just been sounding the alarms, going through everything and just banging on the, on the doors. Hey, this is where they're at now. No one's paying attention to this. And just kind of raising that awareness has brought a lot out. You've had a lot even in malware and doing things like that. You can kind of track that way. But once you started seeing the IT workers and the insider threats on that angle, that's whenever you started realizing you need to create these databases. And so for the past several years, many, many, many different people around the world have gone to do that. And so we're much more knowledgeable now than we were in years past. That's for sure.

Cool, cool. Michael, if I could ask for a favor, could you sort of give a sort of like a high-level summary of the reports to the viewers so they understand roughly what we're going to be talking about. What is it? What are they trying to achieve? The different levels? What's the driving force? Why are people being recruited internally, like students and so forth? I know it's all very much around survival, but it's quite different when we compare it to, for example, to China or Russia or even Iran. So If you, if you could give sort of a high-level summary of what the report is all about, that'll be great.

Absolutely. Absolutely. So if you want to break the report down into— it's a big report, and I apologize for that, but it's a big report and you could break it down into thirds. So the first third is the problem. And I am not— like we were talking before the call, I am a redneck. I'm down here in the South. I don't know much. But I— and so for me to say the scientific method, the first step in the scientific method is you know, identifying and starting with the problem. And one thing we haven't done with the first part of the report about the first third is, is this is the problem. This is how they're grown. This is who they are. This is how the IT workers and the cyber operators overlap. This is everything we're seeing. And with the Bybit hack, the heist for $1.4 billion, we've got 1.4 billion reasons why we probably need to approach the problem a different way. So that whole beginning is all about identifying the problem and we can state it. Now, I don't have all the answers on how to solve it, but at least we, we know what we're dealing with. The second third is going to be more about the APT actors, how they're grown, and more of like the cyber warriors, how they— then we start blending a little bit in that aspect where we show that the IT workers and the cyber operators do coincide a little bit. And then the last portion is all about the IT workers, how they operate, their money laundering schemes, how their teams are outfitted, pictures of them. And we finish on the end with a nice mitigation. Hey, this is what you should be looking for. This is how you can stop them. Here are 1,000 email addresses that we've gathered from all of our partners and sources and says, hey, you read the report and you're left, you're left scared, to be honest. You're like, okay, well, here's something you do now. Just go and look for these personas and these emails in your environment. And that's something you can do now. And again, it gets us all on the same page. So that's kind of the report as a whole. And we really wanted to kind of just highlight that.

That's fantastic. Now, I very much found it a really interesting read.

Thanks.

So can you just briefly explain the idea of them basically trying to get themselves recruited into Western companies? How does it happen? Okay.

Yeah. So, so a big portion of what North Korea is trying to do, you have, you could really sum it up into 3 things: money to fund the regime, weapons to keep them on the global scale, keep them competitive with all the other countries. And then the third one is going to be how you— oh, I'm losing my thought.

That's right.

Okay. What was the third part of it? Oh, AI. You want me to take it back from the top on that?

Okay. That's right. Yeah, that's right. This is so informal.

So, okay. I was like, I don't know if I should or not, but yeah, the AI. Because I mean, with everything that's going on domestically, you need that AI mission to help beef that up. But how they're getting into Western companies and companies globally, Is that's that slow, steady trickle of money. You have your APTs and cyber hacking groups that are getting those large sums of money, but you need that slow, steady drip of actual currency coming into the regime. Yeah. And to do that, you're gonna need to find your ways. Now, this is not different from the '90s. Yeah. We had these guys selling fake pharmaceuticals. If, if Furbies— remember Furbies were such a fad in the '90s? If the Furbies and those toys were still around, we would see them making counterfeit those.

Yeah, yeah, yeah, yeah.

Now we're all in a, in a remote world post, post the pandemic. We're in this very technologically kind of remote workforce, and they see that as an opportunity. Again, this is a criminal enterprise, and criminals will see that as an opportunity to make money. And so by establishing yourself and getting the first years of it, it wasn't pretty and it was a lot more easy to spot, but you didn't know what to look for. Now you have facilitators, you have people standing in on interviews. They're— they look like me. And then as soon as they get hired, the camera never comes on. You've got another person behind the keyboard. What they're doing ranges because IT workers, malicious, say, you know, extortion. You never know what you're going to get. But yeah. But by doing that again, you can— and some of the stuff we're seeing in Australia too, they're actually flipping that model. They're actually trying to get the Australians to come to them. And we are seeing that too. So especially in the civil engineering side of the house, which we can touch on later. But I mean, it's that the way that they're, they're trying to get money and they're willing to do anything to do it. And they're always reading the news and watching things like what we're doing now so they can find the next step and adapt.

Yep. Okay. So adapt to find a vulnerability so that they can attack that vulnerability. Very interesting. How well aware are Western companies to that type of threat?

They're becoming more and more so now. Again, that's part of that whole alarm sounding. Again, the more you, the more you raise it, the more people are aware of it, and then the more people that care about it. Again, once you have, once you see a company with, hey, I hired this person, or they get named and shamed, all of a sudden everyone's like, I don't want that to happen to me. So everyone is getting smarter on the, on the efforts. Um, now I will say that Europe, uh, is, is really putting a hard focus on it right now. We did see not a, not a, it wasn't a shift though, we, it was an expansion. And a lot of people thought they, they stopped US markets and switched over to the other ones. No, they just grew because a lot of those I-9 restrictions and those things that you would catch an IT worker, other companies weren't doing it. And so again, we're all— it's a slow kind of like we're all getting on the same page all at the same time.

Yeah, yeah, yeah. You briefly described this as backed by a criminal network. Obviously, it's a state-controlled nation, mafia-like regime. Yeah. How does it actually work? So you have people now working at global Western companies. Who's running? How's it structured?

Okay. So the model kind of fits many of them. So I'll tell kind of a vague model of it. So first, you need to have an identity. And by that, you can do an overemployment, you know, servers and overemployment communities, and you can get identities that way. There's all kinds of identities you can get off the dark web. Again, people's data, Driver's license databases and passport databases are breached all over the place. So finding first your target, the one that you need, whether it be in a certain country you needed to be in or a certain place, something that you can alter easily, getting that first, who am I going to be? That's the first step. Now, that could either be them with a stolen identity or they could have hired somebody to sit in for them. So you have that process. Yeah. And not to include the recruitment of that. Some— there are recruitment efforts going on in these platform saying, hey, we're looking for people to help us with interviews. You do the interview, we'll do the job. And so there's a market for that type of thing.

Oh, wow. Okay.

Yeah. And from that, like, if I'm in Australia and I need my, my work location, they send me a corporate laptop that I have right here. If I need to look like I'm coming out of Australia, I'm going to need to hire some type of farmer, some type of facilitator that'll hold my laptop in country, in the local host nation country, and then they're going to help me remote into my laptop to do the work So it looks like I'm coming at it from that way. So now we've done— we've got the identity, we've got the job, and now we're doing the job. Now the paychecks will either go back to another facilitator to help get the money to where it needs to be. This money could— if it's crypto, it could be easily just run off with. If it's an actual paycheck, you can have that— that there's several steps of the money laundering. In the report, we actually talk about one from a bank in the US. And then they're detailing it and they're talking to the facilitator trying to get that money to a front company in Hong Kong. Yeah, once the money gets to Hong Kong, they can get the money out. And at that point, it's untraceable.

Okay. I think you're running a bit too fast, but I was going to ask— I was going to ask you the question. So once they're inside, once a North Korean person is inside the company, what are they doing? And are they just working? Are they stealing? Are they planting backdoors? I mean, obviously they're getting paid for the job. And you mentioned how they're funneling the money to Hong Kong and so forth. But once they're in, what are they doing?

Well, not all IT workers are built the same. So it all depends also on which units they're subordinate to. Now, majority of them are revenue generation. But what we've seen though, too, is that when push comes to shove, those guys can be utilized as a human backdoor. We've seen some of the cyber hacking groups Directly communicating with these guys. Actually, we have one hacking group that referred an IT worker to work at a company in case that APT ever needed to get into that company.

Yeah.

So you— and what happens is on the blockchain and with, like, with cryptocurrencies, you can see that because it's all in the ledgers. It's on the blockchain. Extortion attempts, sabotage efforts, that's a little bit harder to see unless a company is actually telling you that it happened. So They could be doing any type of different things to include just being placed there for a time of, you know, a covert piece placed there that whenever down the line they might need to act on it. And we've seen that. So you never know what they're going to have or if they're going to steal that intellectual property such as AI and then go and help grow it back homegrown. So it's many, many different ways. And you mentioned something on that last one. We do see the direct lines to these companies that are like the Rianbong General Corporation. That is a company that sanctioned making weapons of mass destruction and the parts to do it. We see IT workers directly tied to those units.

Okay, cool, cool. Yeah, a side question, because I think you sort of touched on it a bit. Sharing of information or sharing of intelligence. So you could have one section of maybe someone from the 277 research that might be able to breach it, or they've got an IT North Korean IT worker, how do they actually share information? Because they've— it's quite— there's a lot of different organizations that do different things, but yet they're quite happy to share that intelligence from what I see.

The sharing of the intelligence on the North Korean side?

Yes, correct.

So it is interesting. That's some of the harder parts. You can see kind of when it happens. So they are monitored, and we've— North Korea, if anything, they're the most monitored. So If you're, say, if I'm working at a large company, one of the biggest in the world, if I'm working there, I'm inside my channels with my other IT worker friends, and I'm talking about these very sensitive projects that I'm working on because they have to be talking to each other. Because a lot of times there's many IT workers doing the same jobs. You know, sometimes these teams are built that way. But whenever you talk in front of— and again, they're monitored. So you have those program managers, you have those other APT hackers. They can see those conversations happening. So if they see something that they like, or if you're working on something so specific and unique that they could use it, that's something that they don't even realize that they're talking to the advanced hackers. They're just talking openly. Anyone can grab those items.

Yeah. Yeah. Yeah. Yeah. I want to touch on a little bit about who these people are. So I wonder if we could sort of go a little bit back and in terms of how do they find really capable people within North Korea? and so forth like that. What drives them? What's the motivation? Because it's not so much ideology, as you mentioned in the report. So I'd like you to touch on that. And also, I find it exceedingly interesting is they're very happy to steal from one another.

Yeah, yeah. And report them. I've seen some that'll actually— they'll have a profile up and other IT workers will report on that profile saying, Oh yeah, don't— this guy's a scammer. Don't use him. Again, they're looking out for their own team and things of that matter.

Yeah.

But the way how they're growing them though is, is again unique only to them in that they do it at a childlike level. Again, if they have a high aptitude for science and mathematics and really problem-solving skills, that, that's one area that they, they excel at mainly because they don't have a lot of the luxuries that we have here. You know, we have a tool that does this, a tool that does that. They have to, they have to do it all without tools. It's like training at a high altitude. Once you get down to normal altitude, you can run a lot faster. So that's what they're doing and that's how they're grown that way. So when they get these tools, they're like, oh, I can do this without it. So it only helps them more. Again, they're there. And once you do that, then you're kind of in that pipeline through the rest of your career. And depending on what class you are, again, there are several classes in North Korea. Depending on what class you are, it can either bump up you to a higher class or it can solidify you in one, again, making your family's life easier, which is very important because a lot of these families are being held hostage if these IT workers are forward deployed in other countries. Again, very criminal-like. The colleges is kind of where the separation for the hackers and the IT workers kind of splits. And then from there, you know, your best of the best will go to certain units depending on it. Reconnaissance General Bureau, your real out your intelligence gathering, that's going to be your highest one, and then all the way down to just revenue generation.

Have you ever seen— this is maybe a bit wild of a question— have you ever seen maybe a North Korean that said, you know what, the money that I make, because they give pretty much most of it away, the money that I make from, let's say, cybercriminal activities, I'm going to keep it for myself. I'm going to set up my own account. Somewhere. Would that ever happen?

It would never happen, but I've seen it happen on a very small scale, as in like one time we had one, more of an APT operator that was operating with an IT worker. They had access to a computer, so they went ahead and ransomed it just because they were there. That's an unsanctioned event, and that's something if they found out, they would get in very— they'd probably be, I mean, executed. I mean, they— it's very, very strict laws over there, rules over there. But no, I've never seen that happen at that level, kind of a run. But you have to assume some of those are happening again. We have had defectors come from some of these teams before, so that is important. We've actually— there's been— there's a podcast out that was talking about it where they actually interviewed an IT worker that had defected to South Korea. So if you are going to do it, you better be ready to run because, I mean, it's not much for you after that.

Yeah, I suppose the question, what happens to the family? So if, if a North Korean decides to defect and successfully does that, what happens to the family back at North Korea?

I mean, I'd have to assume execution. I'd have, or, or some type of a labor concentration camp of some sort.

Yeah. Just talk briefly about that survivability concept a bit more. What that, that real driver, because I think in the Western world, we tend to be driven by predominantly money. You know, I'm looking for a better job, a better role, a better position in management. And what's interesting in the report that you said that a lot of the students, after being there for quite a while, they don't disappear, they become professors. Yes. So I found it interesting. What you're talking— and obviously, um, from my understanding is even though they may have reached like a level of teaching, they're still part of that network. They still need to fund. And, and I find it amazing that they have to find themselves— when I say find, fund— they have to earn the money to ensure that their operations are You know, viable, credible, you know, so that— and that they can still do the operations that they needed to do. They don't get money from state-sponsored. So it's a completely different frame than what we're used to in the Western world.

Yeah. And also, if you go back to the Sony hackers, you'll probably remember that very famous picture of Park Jin-hyok, the wanted photo, you know. I thought it was interesting. And it's something that no one really talks about. I've put that— when I worked at Mandiant, I put some reporting out about that. But whenever he wasn't doing WannaCry or when he wasn't doing Sony, we have from our own intelligence, we have— he was doing IT worker stuff. So there isn't a day off if you're in between cyber hacking missions. It's okay, well, I guess I'm going to go do IT work and do like legitimate stuff. Legitimate stuff. Again, this is an APT-level guy that was doing IT work, building apps for people in between missions. And so, yeah, we stopped hearing about those guys from yesteryear. Yeah. Yeah. And it's a closed-off country, so you can't find out where they're at now. But then you'll see tiny little remnants. You'll see a name that you knew was associated with those other guys. Again, big on the Greek mythology— Zeus, Hades, those guys. Those are the guys from yesteryear, but you still see them and you see them almost in a kind of an honorific, as if like, hey, they're in charge now. And again, you might see them stretching across multiple teams too. So, you know, also with some of the defections we've had, from the Polysci side of the house, you can see that there is a hierarchy there and you can progress. I mean, where were we both at 11 years ago? I mean, we've progressed to where we are. It seems that they are too.

Yeah. A quick side question. Is this a 24/7 operation? I mean, you can't expect them to be working 24 hours, but from the mention in your report, they work extremely long hours. So when they finish, is there another team that follows up, or how does that work?

Um, on the crypto side of the house, you can kind of see that a little bit more. I mean, there's always going to be teams, but then again, the teams are kind of— they're kind of located within themselves. So you do see off-hours, you're just not seeing many of them. And to follow back on that last question you had too, the survivability, you see them having contests— who can make the most money this month? And it's like, oh, that's dangling the carrot. But also the lower-level guys, They'll get beat. They'll get sent home. It is back to your survivability point there. The work hours are interesting. They're working long hours. We've actually seen some where, so it's a forty, you know, a forty-hour work week or forty-hour whatever. You'll see guys that won't work all week long on a project, and then you'll see ten of them all at the same client working sixteen hours. Unsustainable, but all of them are doing it all in one day again. If you're looking at behavioral aspects, you can tell in your network that something's really off here.

Yeah, yeah.

But the hours worked, again, it is, it is very, very, very limited off time. And depending on what level of IT worker, you might not get really any free time. We've seen some eating steak dinners at times if they're being rewarded for good things they've done. But yeah, it's, it's, it's a very high tempo. I'm not seeing a 24/7 operation. There's always North Koreans attacking, but it might not always be from the same team.

Yeah. Are they attacking any country where they can make money? So it's not just Western countries like the US, Europe, Australia. Are they attacking— I mean, you mentioned something about that they cyberhacked to get the Russian blueprints of their ballistic missiles and so forth. Yes. And then a few years later, they're providing them with With a number of frenemies. Yeah, I find it quite so. So wherever there's an opportunity, obviously they're trying to take an advantage and so forth. So that are they also thinking a little bit like the way the Chinese do in terms of let's let's target let's say a country like Australia because Australia has got such a strong relationship with the U.S. so they can leverage a sort of a step. rather than do it direct, they can, you know, target maybe someone within Australia that's got relationship in the US government or military or aerospace. Are they also in that sort of mindset a bit, let's say, like the Chinese do?

Yeah, and I think that's where you start breaking down the different teams. If it's a revenue generation one, and I mean, go on to any job platform site now and type in the word remote role, and then they have their searches set up that way. So they basically, and I've seen the searches based on some of our collect, In their search, they, they're doing Google dorking is a term that they, they use. And it's basically, I'm looking for any of these jobs, and then they'll point that string at a job website, and then all the listings will be the jobs, and then they'll have it automated so they can do that. Now they're looking for any money because it is, like you said, survival. So we've seen them going all the way down to something as small as like a sticker company, getting just very, very little money. All the way to, you know, you want the higher paying jobs and you can kind of pivot that way. But whenever it comes to terms about, are you gonna start maneuvering into like a cyber espionage aspect? We are seeing that too. We've seen some IT workers at a defense industrial base. One of the very first days on the job, he's like, hey, can I work on any classified stuff by chance? I'm really interested in that.

Yeah.

Okay. I know what you're doing. So again, it's depending on which one you're after and which, which directive they may have. But on that same point too, and kind of going back to our previous one, if you have— we've seen this— a revenue generation IT worker, he'll just get a wild idea. He goes, I'm gonna hack this company to try and impress leadership back home and maybe it'll increase my stock and my family stock too. So you never know which one you're gonna get if you hire one in your network.

Oh, okay. Tell me a little bit about how they're able to get around sanctions. And obviously, you know, North Korea pretty heavily sanctioned. How do they funnel money? How do they get around it?

Well, we'll use an example for the— this was a public, an open-source one that we worked on maybe a year and a half ago with me and a couple of the guys. So we were able to access some of the North Korean infrastructure and through a variety of ways, and we were able to see some animation projects. And we were like, okay, well, what is going on here? We didn't think this was an IT worker mission because, again, An IT worker can come many, many different ways. So what they were doing was, is internal to North Korea, they were making for major— for streaming platforms that I can guarantee you and I both have. They were making animations for shows that are very, very popular in the world. And what they're doing is they were then shipping them off there, uploading them to a cloud instance. And then over on the China side, in the area I believe is Dalian, they would then download on that side. They would put a watermark on the animations. The front company was set up for Dalian Animation Studios or something to that effect. And then that is now coming out of China. You're allowed to do that. These Western companies were buying them. And then until they found out that they were hiring IT workers, then they didn't, they didn't know they had a problem.

Yeah.

And there's so many operations like this that they're much more ingrained in our, the fabric of our society than we really know. Because a lot of times they're doing quote unquote legitimate work for things that we use now.

Oh, wow. You mentioned in the report about AI. How are they using AI and for what different ways are they using AI?

Top to bottom, they use it. So they can either, for an IT worker, but yeah, all of it. Even, even, even to the, down to the, to the lower levels of the extortion schemes using AI for that, AI for using their own, for resume building, AI for using their facial This is one that we have right now, is that we have here in Florida where I'm at, we have a staffing recruitment agent was helping the IT worker actually get a job at an AI place here in Florida. It's funny because we actually could see the IT worker's screen, and in his screen he said, I'm sorry, my— I can't talk, my microphone's broke, but I'm a fast typer. Oh, okay. So in the screen you can see the subtitles. And so he was copying them on the screen and then putting them in ChatGPT on the side of it to answer the questions. And the whole time I could see the guy's face. He thinks he's typing the answers out. So they, they use it for their jobs. They use it for the extortion schemes. They use it for literally top to bottom. They're looking for AI to amplify everything that they're doing.

Oh, whoa. Is, is this something that we should be even more concerned? I mean, could they use AI even to be more malicious in intent?

100%. 100%. And we think that was a big part of that Research Center 227, is that, I mean, think about it, they're successful right now as is. The last thing we want, you know, the old Terminator days, we didn't— AI and machines and robots, it's all good when it's us, it's the good guys doing it. But what happens if you have AI in a bad guy's hands? And they've pretty much said it right there. We're gonna use this AI to help attack cybersecurity companies. We're gonna help. We're gonna build our own. It seems like they're building their own AI internal so that when they're cut off from the world, they have their own AI models.

I wouldn't be surprised.

Yeah. And they're, they're helping with the exploits for the APT actors too. They're helping them, like, beef up and attack harder, which is exactly what we don't need because they're successful even without it, let alone now with it.

Yeah. So right now, these operations seem to be flying under the radar. You know, they're, they're quiet, covert, largely unnoticed. But how close are we seeing something more disruptive or visible? For example, could we see operatives shift from silent infiltration to actually causing public damage?

I think so. Right now, this is a good— this is such a great question. Right now we're in such a quote-unquote time of peace that right now it's more of moving all your chess pieces in place.

Yeah, that's right.

You know, if you have— if I've got IT workers that are malicious or that are doing ransomware or any type of attack like that. One, have they ever done that in the past? Sony has told us that if they are insulted, they will do it. Dark Soul in Korea, that is another destructive attack that they did. Not to mention that specific hacking group is tied to the IT workers. So that's not good. Have they done it? Do they have the means to do it? Yes, they have placement access all over the world with these insider threats that have their They might not be the ones that are doing the attacks, but all of their friends that they communicate with in some way, shape, or form can. So I think right now, if we get into a, a type of a global conflict, you can easily have all these guys detonate where they're at, and then you're gonna have a real problem. And the more and more we're seeing these IT workers turn to malicious activities, extortion attempts, again, they're harder to see unless people are talking about them openly, not just on the crypto side. Yeah. I think right now it's more of a— they're putting all their chess pieces in place.

Okay, interesting. So the purpose of this report that you did and a few of your colleagues, what was the purpose? Obviously, you know, I work in the insider threat domain and you don't get that much news. You know, you would get it on YouTube and say, oh, that's quite an interesting story. What is the purpose from your perspective of why you brought this interesting report?

I think it's to help keep the conversation going. And also, another thing is that we have a bunch of pieces of the story, but no one's really made the story. So right now you can go on Twitter, you can go on whatever, YouTube, and you'll catch, these are the IT workers here. Who are the IT workers? Where do they come from? Why are they doing this? And kind of get to the point. So in this report, we boiled everything down and then it's Like I said, I don't have all the answers. I— we put this report in front of, you know, policymakers in the government, whichever government, and it's like, how are you— how do you see this report and how are you going to help it? Because even now, like, you might have working with, you know, your different law enforcement agencies, hey, I have IT workers right here right now, we got to go take care of them. But then maybe something on their policy side of the house might take them so long to act on it that they might be gone by the time you do it. So everyone has their own piece. Crypto companies, a lot of crypto companies aren't doing verifications. And that's actually one of the areas where they're hitting Australia is the crypto areas there. And so it's, it's, it's mainly this is the problem. And then it's just kind of taking it to everybody. Like, what are you gonna do about it? What are you gonna do about it?

Yeah.

I was gonna ask that.

Yes. Well, what are you hoping that businesses, organizations, even governments take from this?

Right now, hemorrhage the bleeding. Because a lot of times there's a bunch of— we act kind of like ostriches with our heads in the sand saying, this can't happen to me. And by the time that it does happen to them, then it's happened. So knowing that it's happened to all of our friends and thinking that we also are a part of this, and then also the fact that we are in all these silos, everyone has their little piece. I'm gonna make— this is proprietary, I can't tell you. Sometimes you need to share and collaborate because With the success rate that they're having right now, the time is now. Whenever you start introducing— whenever I see IT workers searching out AI, looking for AI intellectual property, and we are starting to see AI suicide drones, knowing that we have an active conflict in Russia, it's like this isn't a cyber problem anymore. Like, lives are now on the line. So it's more of a sense of urgency.

Yeah. What is the real cost if we don't do anything? So we'll— yeah, if the Western governments and they say, okay, yeah, we just don't have— it's not a priority. We don't have the funds or focus or what is the real cost if we do nothing?

I think we can look back to answer that question. We can look back at what has happened when we've dragged our feet. And so again, we haven't been addressing this problem correctly or efficiently or effectively. For years. So how does that look in North Korea? Well, flashback a few years ago before they had the research and development, the funding, the IT workers, these, these missiles were exploding on the launch pads. Not to mention that North Korea, it's not like Australia and America where it takes so much money to launch a missile. They're launching missiles between $2 and $5 million. So their money they do make go a long ways. Yeah. And so $1.4 billion sounds like a lot of missiles. So we're at the point now where missiles were detonating on launch pads to now they're successfully being launched, and so much so that they're actually selling them to our adversaries such as Russia and things like that. Right. So I think what's more of that, and also on a larger scale too, because, um, I don't want to skip ahead to like the— to way ahead, so I'll pause on that. But, but I mean, seeing how successful they have been and seeing how far they've come in such a short time frame, both on the APT operators and the IT workers, I think it's showing that they're closing the gap quickly. And if anything, they might be getting ahead of us.

Yeah. So if this is where North Korea's cyber program is today, where do you think it's gonna be in the next 5 years?

Well, with the training that they're doing, so right now we do see that the colleges are pumping out more and more students. And with the implementation of AI, that bar for entry, I mean, Boaz, me and you and AI, we're gonna be like, Huh, you know, them trained up on it, they're— they know how to use it efficiently. They always have that word of like, is AI going to take my job? No, a person who knows how to use AI will take your job. That's how it's going to be.

Yeah.

So you're creating this force, this fighting force, and they're only multiplying more and more as the colleges push them out. I think, I think going forward, especially as traditional financial institutions start to implement like blockchain technologies, Now you're gonna have an area that they're already very well versed in, and they can start attacking our financial institutions. So I think if, you know, push comes to shove, you could have some SolarWinds level of events, the global SolarWinds efforts. You can have those around the world by just letting them just do whatever they want.

Yeah. Yeah. So I know your report talks about the mitigation or some, some— what are the things that We should be doing collectively moving forward?

Collectively, I think one of the lowest cost, high yield efforts that's been really producing right now is training up HR and recruitment staff. Again, there's so many resumes and so many applications that go across these guys' desks a day that once you start training them up, and we have been showing this is what bad looks like, this is whenever they do this, don't, don't fall for it. Make them turn their camera on or do this, or we're constantly checking on being situationally aware. has helped out. But collectively, I think, I think collectively, I think verifying our workforce, if we are in this new remote work world, which we are, then finding new efforts to make sure the people that work for us are the people they say they are and are they doing the right things. You can stop them before they get in. But if they do get in, do you have the technologies to be catching insider threats? Do you know what an insider threat looks like whenever, you know, not just North Korea, but any fraudulent employee? Correct. If they're in your network, do you know what they look like?

Yeah. What is the key takeaway from the report?

I think, I think the key takeaway in going ahead is one, the problem isn't slowing down. If anything, especially in the past year, we've only dumped gasoline on it. Not we, but gasoline. I didn't do it. Neither did you. But gasoline is officially on the fire and you have to only look. I mean, if I could show you my screen right now and my sensitive stuff that would get me fired. You would see how many of these people are at organizations all over the world, and you realize we are in danger. So the key thing is that we are all in this together. We are all affected. Nearly every company has had some type of way, some something there, minus, you know, like a manual job. Yeah. That, and then also where we see the future in regards to blockchain. IT workers and North Korea as a whole has really adopted blockchain technologies. The more we make them more mainstay in our society, which is good. That's a good thing. But we were seeing that run on banks in 2016, 2017. Oh, you know, hack my banking. You notice you haven't heard about that in a little while. They're making too much money on the crypto side of the house. But now banks and financial institutions are implementing that. And so they're licking their chops. They want you to get there because they know that better. They're at the finish line waiting for us to catch up. And I think that's a big takeaway. And also, The, the fact that an IT worker isn't just there for revenue generation. At any point in time, they can become malicious and really do damage. And an insider threat's one thing. You don't want that. An insider threat that's trained and knows how to really do APT-level damage.

Yeah.

Terrifying.

Yeah. Yeah. Yeah. Are you intending to release a regular report like every year or every few years? I'm just curious.

If there's an appetite for it. I think at the time this was a bit of a more of a one and done, just get the word out too. And but I think it— I think there might be an appetite for that because this is the copycat league and we're already starting to see criminals do more of these IT worker scams. And it's only a matter of time, if not happening already.

Yeah.

China, Russia, Iran doing some of these. And we are seeing some IT workers subcontracting out to criminals In Iran, in Pakistan. So I think it's— we may be doing something more periodically, but right now I think that the other countries are starting to catch notice and saying, hey, this is a really good framework. We can do this if they're making so much money off it. Why can't we?

Yeah. Okay. So we're coming to the end. What's the best way should viewers want to reach out to you if they can? Secondly, how do they get a report That would be great.

Yeah, if you— the Detex website has all of our contact information on there. You can reach out to them and they can funnel it, whether it be if you're looking to find out more information on it, if you're looking to reach out to find out more about insider threats. We have other reporting we did. We did in the release of the 1,000 email addresses that came on a report that actually talked about some mitigations to protect yourself. So we do have a couple of reports in there too. But just going to the Detex website and looking through that, it's, it's, it's— we painted all of the site. We're very proud of it. So it won't be hard to find.

Michael, look, thank you. I think I really enjoyed reading the report and I very much enjoyed discussing with you. I could see how passionate you are about it. So it was wonderful. I'm sure the viewers will appreciate your hard work and commitment to bring something that's been sort of quietly hidden to the open. And hopefully that changes some of eyes and to make it sort of more of a priority. I think that's essential.

Yeah. And for you, Boaz, I'll tell you, I'm seeing Australia a lot now. They are, they have their eyes on you guys and there are successes being happened both in your crypto market and onto your civil engineering remodeling and stuff. And I'm seeing a lot of efforts head your way. So I'm if I'm here for a lot of our DTX people are here all Australian. So I have a very big. I'm a big fan of you guys over there. So stay safe and they're coming. So really get ready,

Michael. Thank you very very much, and I hope to one day meet with you as well.

Me too, man. I gotta get to Australia. Never been.

Ah, it's great, great. Thank you, and stay tuned.

Have a good one, brother.