GoKawiilFBI warns North Korean operatives exploit weak identity checks in hiring and onboarding
The FBI has repeatedly flagged that North Korean IT workers are using fraudulent or stolen identity documents, proxy infrastructure and US-based facilitators to pass remote hiring processes and gain access to corporate networks. Rather than stealing existing credentials, these attackers get organizations to create new credentials for them during onboarding, exploiting the fact that Zero Trust and MFA controls assume an identity already exists. The FBI now recommends verifying identity both during hiring and continuously throughout remote employment.
GoKawiil's interpretation of the reporting above, not reported fact.
This suggests that even organizations with mature Zero Trust and MFA programs may have a structural blind spot at the point where trust is first established, since later authentication controls can only be as strong as the initial identity check. It implies that security teams may need to extend the same rigor used for ongoing authentication to the hiring and onboarding pipeline itself, particularly for remote roles where in-person verification isn't possible. The persistence of these schemes, as described by the FBI, indicates attackers view weak onboarding as a reliable way around otherwise hardened defenses.
- The FBI says North Korean IT workers use fraudulent identities and proxy setups to pass remote hiring processes.
- Onboarding reverses the typical attack model: instead of stealing credentials, attackers get new ones issued to them.
- The FBI recommends identity verification both at hiring and continuously during remote employment.
Source: bleepingcomputer.com, 2026-10-01
Published there as: “The Day-One Hole in Zero Trust Architecture”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.