Thirty thousand devices compromised

North Korean threat actors behind the Contagious Interview campaign have compromised more than thirty thousand devices across one hundred countries and stolen around ten million dollars in cryptocurrency.

Joint investigation by four nations

Law enforcement agencies in Japan, the United States, Germany, and Australia jointly released a report finding that the theft robbed around seven thousand people of their cryptocurrencies.

Campaign runs for four years

Contagious Interview, sometimes called Operation DreamJob, is a hacking campaign running for almost four years. The cybersecurity community attributes it to the government of North Korea, though attribution remains difficult.

Fake personas on LinkedIn

North Korean operatives create entire fake personas on social media such as LinkedIn and apply to hundreds or thousands of job ads across IT, healthcare, and other industries using stolen data and AI-generated images.

Two-way attack method

The operation works both ways. Crooks create fake companies and job positions, then reach out to targets offering lucrative positions. Candidates are asked to download malicious code, unknowingly compromising their employers.

Laptop farms hide true location

To bypass IP address checks, attackers set up laptop farms in countries like China, hosting hundreds of laptops to access targets' networks while concealing their actual location from detection systems.

Agencies issue verification guidance

Agencies warn businesses to verify IP addresses match applicants' claimed residence, check contact information, and validate certifications. If possible, calling an applicant's phone number may reveal it is out of service.

“If possible, verify that IP addresses generally match the applicant's claimed residence. Carefully check all contact information. Calling an applicant's phone number may reveal the number is out of service.”

Watch for group efforts and crypto

Multiple people may collaborate behind a single applicant to inflate perceived skill. North Korean IT workers tend to favor cryptocurrency payment and may request remuneration sent to another person's account.

“Even if a single individual appears to be applying, multiple people may be collaborating behind the scenes, inflating the perceived skill set.”

Campaign expected to evolve further

Security agencies warn that changes to standard practice could happen at any time and variations to the theme should be expected as Contagious Interview continues to develop.