--:-- Jessica Mendoza: Welcome to The Journal, our show about money, business, and power. I'm Jessica Mendoza.
--:-- Ryan Knutson: I'm Ryan Knutson. It's Tuesday, September 10th.
--:-- Jessica Mendoza: Coming up on the show, could your new hire be a North Korean spy?
--:-- Ryan Knutson: We'll be right back.
--:-- [Exciting music plays]
--:-- Announcer (Voiceover): On Brand with Jimmy Fallon. Series premiere Tuesday on NBC.
--:-- Announcer (Voiceover): Hey, business owners. We know you know the importance of maximizing every dollar. With the Delta Sky Miles Reserve Business American Express card, you can make your expenses work just as hard as you.
--:-- Announcer (Voiceover): From afternoon coffee runs to stocking office supplies and even team dinners, you can earn miles on all your business expenses. Plus, you can earn 125,000 bonus miles for a limited time through October 29th.
--:-- Announcer (Voiceover): The Delta SkyMiles Reserve Business Card. If you travel, you know. Minimum spending requirements and terms apply. Offer ends October 29th, 2025.
--:-- Ryan Knutson: Our colleague Dustin Volz reports on hackers and cybercrime, and he's been really busy lately.
--:-- Dustin Volz: Well, it is an election year, and so I have been focused a lot on foreign election influence efforts targeting the presidential election, including efforts by Russia, Iran, and China to promote covert online propaganda and disinformation and that kind of thing.
--:-- Ryan Knutson: And just kind of looking through the stories that you written recently and it sounds like foreign governments really want to get into our computers this year.
--:-- Dustin Volz: Yes, they always do. They always find new and interesting ways to try to get into our computers. Governments really like to be inside our computers for all sorts of reasons.
--:-- Jessica Mendoza: One government that's constantly trying to do that is North Korea.
--:-- Dustin Volz: For years, I've tracked how the country has developed its hacking capabilities, and it says its main goal is to make money.
--:-- Jessica Mendoza: Money is absolutely a driving force of this.
--:-- Dustin Volz: Because of the sanctions, because of how hard it is for them to get money really through any other means, that is a huge part of what this whole operation is about.
--:-- Jessica Mendoza: And it's really existential for Kim Jong-un and his regime, because if they're not able to keep funding their nuclear weapons and ballistic missile programs, they sort of lose their ability to stay in power potentially.
--:-- Dustin Volz: So money is absolutely a huge part of this.
--:-- Jessica Mendoza: North Korea makes money through hacking in a variety of ways, like stealing cryptocurrencies or holding Western companies ransom.
--:-- Dustin Volz: But last year, I learned about a new North Korean scheme that's unlike anything I've seen before.
--:-- Jessica Mendoza: I spoke to a senior Biden administration official who said, we're really worried about how much money the North Koreans are able to get through not just hacking into companies and stealing intellectual property and in some cases stealing cash, but by doing these other sort of crazy schemes.
--:-- Dustin Volz: And this official said that IT workers are a really big concern.
--:-- Jessica Mendoza: And I said, I'm sorry, IT workers, what do you mean?
--:-- Dustin Volz: And they said we are seeing a growing number of North Koreans get jobs by stealing identities of foreigners and getting onto the payroll directly for employers for IT jobs and other sorts of technology jobs.
--:-- Jessica Mendoza: And I just thought that was fascinating.
--:-- Dustin Volz: These North Korean job seekers are in some ways just like any other job seeker. They make resumes, set up a profile on LinkedIn, and display professional headshots.
--:-- Jessica Mendoza: But it's all fake.
--:-- Dustin Volz: Their identities are stolen. And often, their resumes and headshots are made with generative AI.
--:-- Jessica Mendoza: They apply for dozens of jobs and wait to get an interview.
--:-- Dustin Volz: And maybe this is obvious, but they're only looking for remote jobs.
--:-- Jessica Mendoza: When they land that interview, Dustin says they stand out.
--:-- Dustin Volz: It's surprising both the level of skill required here and also the level of persistence.
--:-- Jessica Mendoza: They're really being thoughtful about it. They're being methodical about it.
--:-- Dustin Volz: And once they get a bite on one of their lures, they're really trying to reel in the employers and get the big payday.
--:-- Jessica Mendoza: And you've talked to some of these employers.
--:-- Dustin Volz: I think a clear and consistent message from these companies was, wow, these guys are really, really good at this.
--:-- Jessica Mendoza: They were kind of stunned by the level of sophistication from a technical level in understanding the jobs that they were applying for.
--:-- Dustin Volz: And really surprised that they were able to not just, you know, send in an application and then hope to get hired, but follow up on it, talk about their strengths and weaknesses in interviews, actually get on Zoom interviews and pose as the person that they were pretending to be.
--:-- Jessica Mendoza: And speak in English with, you know, an accent, but speak in English when you're talking about highly technical terms.
--:-- Dustin Volz: And I think that is, you know, again, something that a lot of companies are probably not expecting.
--:-- Jessica Mendoza: For the North Korean operatives who land these jobs, the pay can be pretty good.
--:-- Dustin Volz: The Justice Department said some alleged spies were making $300,000 a year or more.
--:-- Jessica Mendoza: A certain percentage of those salaries will go back to the regime and then they might get to pocket some of it for themselves.
--:-- Jessica Mendoza: It's unclear exactly how many North Korean operatives are working for U.S. companies.
--:-- Dustin Volz: But U.S. officials say the number is potentially in the thousands.
--:-- Jessica Mendoza: In one indictment, prosecutors said more than 300 U.S. companies had unknowingly hired people with ties to North Korea.
--:-- Dustin Volz: North Korea's diplomatic mission at the United Nations didn't respond to a request for comment.
--:-- Jessica Mendoza: Now, when I got hired, you know, I got a laptop. I got a badge. I got a free Wall Street Journal Tumblr.
--:-- Dustin Volz: I'm jealous you got a free Tumblr. I never got one of those when I was hired here.
--:-- Jessica Mendoza: So, yeah, like a lot of jobs, you get hired on and you're given a phone and a laptop and all that.
--:-- Dustin Volz: But maybe you show up the first day in the office and you're handed these devices and you sit down with your IT team and your HR team and you boot up your systems and you're ready to go.
--:-- Jessica Mendoza: If you're working remote, you might just send it to an address, the address on file that the applicant said that they live at.
--:-- Dustin Volz: But these North Korean operatives are not in the U.S. They work out of North Korea, China, or other countries.
--:-- Jessica Mendoza: To fool U.S. employers, they need help from accomplices on U.S. soil.
--:-- Dustin Volz: Enter the laptop farms.
--:-- Jessica Mendoza: And we seen that now in at least three states Tennessee, Arizona, and Washington where there were these laptop farms that were sort of participating in the scheme where co are essentially helping them get these jobs by providing them a residence.
--:-- Dustin Volz: Once they get the job that they've applied for, they have their work devices sent to this address, set up on a rack, plugged in and turned on.
--:-- Jessica Mendoza: And then the North Korean, who might be in China or North Korea itself or somewhere else, is able to basically remotely get onto that laptop.
--:-- Dustin Volz: And so these laptop farms, is it just basically like a warehouse full of all these different laptops and a couple people kind of running this operation?
--:-- Jessica Mendoza: It's even more bootstrapped than that.
--:-- Dustin Volz: These are going to be just like homes. You know, just like imagine any suburban road in America, and it turns out that they actually have hundreds of laptops inside in their living room that are sitting on racks and basically helping North Korea fund a nuclear weapons program.
--:-- Jessica Mendoza: That's a direct threat to the United States.
--:-- Dustin Volz: The people running these laptop farms are paid thousands of dollars by North Korea.
--:-- Jessica Mendoza: That's according to federal prosecutors, who've arrested several of these middlemen.
--:-- Dustin Volz: One man in Tennessee was allegedly promised $500 per laptop, plus a percentage of profits to help the North Korean government.
--:-- Jessica Mendoza: That man pleaded not guilty, and his lawyer did not respond to a request for comment.
--:-- Dustin Volz: So once they're all set up, you know, they've got their laptops, all of that, what do the North Koreans do?
--:-- Jessica Mendoza: A lot of them do their jobs.
--:-- Dustin Volz: A lot of them get hired. They're able to collect, you know, paychecks for hundreds of thousands of dollars annually because they are sitting back and doing the job that they were hired for, which is, you know, troubleshooting people's laptops and doing all sorts of things.
--:-- Jessica Mendoza: And then in some cases, we see them also using their access within internal networks to not just do the work they're hired for, but to do other malicious things, including stealing corporate secrets or positioning for other types of cyber attacks.
--:-- Dustin Volz: And so it just, I think, depends on case by case, but there's a number of sinister things that they can be doing once they're hired.
--:-- Jessica Mendoza: Whatever the exact scheme, the main goal, Dustin says, is still to funnel money back to the North Korean government.
--:-- Dustin Volz: So if you think your company may have hired a North Korean spy, what do you do?
--:-- Jessica Mendoza: That's next.
--:-- Announcer (Voiceover): Mint is still $15 a month for premium wireless. And if you haven't made the switch yet, here are 15 reasons why you should.
--:-- Announcer (Voiceover): One, it's $15 a month. Two, seriously, it's $15 a month. Three, no big contracts. Four, I use it. Five, my mom uses it.
--:-- Announcer (Voiceover): Are you playing me off? That's what's happening, right? Okay. Give it a try at mintmobile.com slash switch.
--:-- Announcer (Voiceover): Upfront payment of $45 per three month plan, $15 per month equivalent required. New customer offer first three months only, then full price plan options available. Taxes and fees extra. cmentmobile.com.
--:-- Ryan Knutson: Running a business comes with a lot of what-ifs, but luckily there's a simple answer to them. Shopify. It's the commerce platform behind millions of businesses, including Thrive Cosmetics and Momofuku, and it'll help you with everything you need.
--:-- Ryan Knutson: From website design and marketing to boosting sales and expanding operations, Shopify can get the job done and make your dream a reality.
--:-- Ryan Knutson: Turn those what-ifs into sign up for your $1 per month trial at shopify.com slash special offer.
--:-- Dustin Volz: Would you say that you're an expert on cybercrime?
--:-- Stu Schauerman: Unfortunately, yes.
--:-- Dustin Volz: Unfortunately? Yes, you have to watch it.
--:-- Stu Schauerman: But you could call me an expert on cybercrime.
--:-- Dustin Volz: Indeed. That's Stu Schauerman again. He's the CEO of the company that accidentally hired an alleged North Korean spy named Kyle.
--:-- Stu Schauerman: What I didn't mention is that his company is a cybersecurity company. It's called KnowBefore.
--:-- Dustin Volz: And so what was the goal with KnowBefore?
--:-- Stu Schauerman: The goal was to provide employees with sufficient training and simulated attacks so they could make smarter security decisions every day.
--:-- Dustin Volz: After Kyle released his malware, the company acted fast.
--:-- Stu Schauerman: We have a very sophisticated InfoSec team who are intimately familiar with hacking procedures.
--:-- Dustin Volz: And they literally saw malware being downloaded to the hard disk of that particular workstation.
--:-- Stu Schauerman: So we were able to remotely shut that workstation down.
--:-- Dustin Volz: Did the malware spread to other systems within the company before you were able to shut it down?
--:-- Stu Schauerman: No. It was quarantined. It did not go any further than that particular laptop.
--:-- Dustin Volz: Stu's company alerted the FBI about Kyle.
--:-- Stu Schauerman: How did you feel after this ordeal?
--:-- Dustin Volz: Well, you think that, wow, we've been lucky. Our layered defenses actually caught this in time.
--:-- Stu Schauerman: However, we need to sharpen up our process because they should never have come this far down.
--:-- Dustin Volz: We should never have sent that laptop to begin with.
--:-- Stu Schauerman: So you immediately take measures as in workstations never get sent to anywhere else but to where this person lives.
--:-- Dustin Volz: This person actually needs to go and signs for it themselves with an ID showing that they are who they are.
--:-- Stu Schauerman: So we have made immediate improvements in our process.
--:-- Dustin Volz: I'm curious what you think this says about how hard it is to stop something like this from happening, especially for companies that aren't as well defended as yours.
--:-- Stu Schauerman: It's hard.
--:-- Dustin Volz: The learning moment here is that everyone who is hiring for people that are going to get the keys to the kingdom, and system administrators and software developers very often have those keys to the kingdom, that they need to be double, triple sure that these are legit and not operating criminals.
--:-- Stu Schauerman: But you have to truly watch it to make sure that you don't hire these types of people who can essentially cause enormous damage.
--:-- Dustin Volz: If you could talk to Kyle today, what would you say to him?
--:-- Stu Schauerman: Nice try, buddy. No cigar.
--:-- Dustin Volz: Stu's company was able to quickly suss out and deal with the alleged North Korean spy in its ranks.
--:-- Ryan Knutson: But the same can't always be said for other companies.
--:-- Dustin Volz: The Department of Justice estimates that North Korea makes hundreds of millions of dollars every year from this scheme.
--:-- Ryan Knutson: One company I spoke to actually said that they think they've encountered eventually dozens of applications that they suspect are North Koreans.
--:-- Dustin Volz: Can you imagine telling the people who work for you, sorry folks, we accidentally hired a North Korean operative?
--:-- Ryan Knutson: It honestly, to me, it really is a strong case against remote work.
--:-- Dustin Volz: Employers for a long time have been trying to get their workforces back into the office.
--:-- Ryan Knutson: And I think a lot of their arguments are not personally not very valid.
--:-- Dustin Volz: But this one, the idea that this is a real security risk and that we might actually accidentally be hiring people who are helping to fund North Korea's nuclear weapons program because they're on the payroll here.
--:-- Ryan Knutson: You know, I think that's a really startling thing to a lot of people.
--:-- Dustin Volz: Dustin's reported on a variety of weird and ambitious hacking schemes.
--:-- Ryan Knutson: But even to him, North Koreans taking IT jobs hits different.
--:-- Dustin Volz: I think this is one of the most fascinating and unusual cyber crimes I've ever seen.
--:-- Ryan Knutson: And it speaks to where we are now in our world with remote work and where we are in our world with AI systems that allow people who speak a foreign language to ask an AI system to make them resume or to create a fake headshot for them.
--:-- Dustin Volz: And I think this is potentially a preview of really, really scary things to come.
--:-- Ryan Knutson: And I think it also says a lot about how crafty North Korea is.
--:-- Dustin Volz: We often talk about China and Russia as these big, bad cyber baddies, and they are.
--:-- Ryan Knutson: But North Korea time and again over the years has been incredibly, incredibly sophisticated and tricky with what they're doing through cyber attacks and through cyber fraud.
--:-- Jessica Mendoza: Where do you think Kyle is now?
--:-- Dustin Volz: Do you think he's at another company and his name is Dustin?
--:-- Jessica Mendoza: Oh, gosh, I hope not.
--:-- Dustin Volz: I feel like stealing my identity would be a bad idea because they would know that I don't have the technical fluency required for the job.
--:-- Jessica Mendoza: Yeah, I don't know where Kyle is.
--:-- Dustin Volz: I think Kyle is probably still, you know, sitting in a cubicle in some office building, either in North Korea or China, spending hours applying jobs and waiting for one of those resumes that he sends to get a bite from an employer.
--:-- Jessica Mendoza: And he's probably waiting to put on a tie for the next time he needs to appear in front of a Zoom camera and pretend to be someone who he says he is.
--:-- Ryan Knutson: That's all for today, Tuesday, September 10th.
--:-- Jessica Mendoza: The Journal is a co-production of Spotify and The Wall Street Journal.
--:-- Ryan Knutson: If you like our show, follow us on Spotify or wherever you get your podcasts.
--:-- Jessica Mendoza: We're out every weekday afternoon.
--:-- Ryan Knutson: Thanks for listening. See you tomorrow.
