UnknownPublished 30 Jul 2025

OSINT · From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West

Impact

For European organizations, the presence of North Korean remote workers linked to state-sponsored cyber operations poses significant risks to confidentiality, integrity, and availability of sensitive data and systems. Potential impacts include espionage, intellectual property theft, financial fraud, and disruption of critical infrastructure operations. The covert nature of insider threats complicates detection and response, increasing the risk of prolonged unauthorized access and data exfiltration. Organizations in sectors such as finance, telecommunications, energy, and government are particularly vulnerable due to the strategic value of their data and services. The integration of remote workers, especially from regions with adversarial geopolitical relations, can introduce backdoors or facilitate supply chain compromises. This threat can undermine trust in remote workforce models and may lead to regulatory scrutiny under European data protection and cybersecurity laws. The medium severity reflects a moderate but tangible risk that requires proactive management to prevent escalation into more damaging incidents.

Defensive guidance

European organizations should implement rigorous identity verification and background checks for remote workers, especially those from high-risk regions. Deploy continuous monitoring solutions that leverage behavioral analytics and anomaly detection to identify suspicious insider activities. Enforce strict network segmentation and least privilege access principles to limit lateral movement opportunities. Utilize multi-factor authentication and zero-trust network architectures to reduce the risk of unauthorized access. Conduct regular security awareness training focused on insider threat recognition and reporting. Integrate threat intelligence feeds related to North Korean cyber activities to enhance detection capabilities. Establish clear policies for remote work and supply chain security, including contractual obligations for transparency and security compliance. Collaborate with national cybersecurity agencies to share intelligence and receive guidance on emerging threats. Finally, perform regular audits and penetration testing to identify and remediate potential weaknesses in remote access infrastructure.

Indicators of compromise

Domains 6

mirotalk.netcontagiousinterview iocs - C2
payloadrpc.comcontagiousinterview iocs - C2
ipcheck.cloudcontagiousinterview iocs - C2
regioncheck.netcontagiousinterview iocs - C2
w3capi.marketingcontagiousinterview iocs - C2
telegram-mini-app-game-main.zippacked_beavertail_hashes.txt

URLs 18

GamerHub/server/middlewares/helpers/error.jspacked_beavertail_hashes.txt
https://github.com/Satyam-G5
https://github.com/aufeine
https://github.com/dhayaprabhu
https://github.com/bridgitlab
https://github.com/CodePapaya
https://github.com/bmstoreJ
https://github.com/Allgoritex
https://github.com/plannet-plannet
https://github.com/komeq1120

IP addresses 22

contagiousinterview iocs - C2

135.181.242.24
147.124.212.146
147.124.212.89
147.124.213.11
147.124.213.29
147.124.214.129
147.124.214.131
147.124.214.237
166.88.132.39
167.88.168.152

Hashes 315

ae83d8531717a5c7696451166acc91f1packed_beavertail_hashes.txt
3b7663f40ab4aa25a97bea17ad1b50ebpacked_beavertail_hashes.txt
f5e89d2643a1e709f6f34f13b2501779packed_beavertail_hashes.txt
47ebe86edb2a8305e48e142389ad5cd0packed_beavertail_hashes.txt
4aea29dadcfd4fc75a27c9902cb4c623packed_beavertail_hashes.txt
72841d2374648bc70dce53fbdcf69502packed_beavertail_hashes.txt
1aaf8809b7ab4fa6848babe3f970afc0packed_beavertail_hashes.txt
9cc9b773fe099d46eca556b610fd03cbpacked_beavertail_hashes.txt
0d4a9a974c4fc579d0699764c69cf0fdpacked_beavertail_hashes.txt
2ad64d0252b9778bdf3911e2924a3885packed_beavertail_hashes.txt

File 15

MiroTalk.dmg
MiroTalk.msi
Jami.exe
FCCCall.msi
FCCCall.exe
FCCCall.msi
FCCCall.exe
FCCCall.dmg
FCCCall.msi
FCCCall.exe

Link 1

https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west

Text 2

In November 2023, a security vendor discovered that North Korean threat actors were using the Contagious Interview and WageMole campaigns to procure remote employment opportunities in Western countries, thus evading financial sanctions against North Korea (DPRK). The Contagious Interview campaign focuses on stealing data, while WageMole uses that stolen data, along with other social engineering techniques, to help these threat actors land remote jobs. Zscaler ThreatLabz recently discovered how the threat actors have continued to update their Contagious Interview campaign tactics by improving the obfuscation of their scripts with advanced techniques and dynamic loading. The threat actors also expanded their arsenal by supporting both Windows and macOS application formats in their infection chains, while keeping their core capabilities intact. By monitoring the installed BeaverTail (JavaScript) and InvisibleFerret (Python) scripts, we confirmed that the attackers stole source code, cryptocurrency data, and personal information from victims. The threat actors managed to infect over 100 devices across multiple operating systems within a short time. In this blog, we’ll dive into the improvements made to Contagious Interview scripts, the new formats that are now supported, and share exclusive insights into the campaign’s victims.
Blog

Community reviews

Loading reviews…