Kraken Exposes North Korean Hacker Posing as Job Applicant
1min read Crypto exchange Kraken recently uncovered an attempt by a potential North Korean threat actor to infiltrate the company by posing as a job applicant. The hacker applied for an engineering position, raising several red flags during the interview process. From the beginning, Kraken's team noticed something unusual about the candidate. The applicant occasionally switched voices during the interview, suggesting they were being coached in real time.
Kraken's security team decided to advance the candidate through the hiring rounds to gather more information about their tactics. Before the interview, industry partners had alerted Kraken that North Korean hackers were actively applying for jobs at crypto companies. During the initial video call, the candidate used a different name than the one on their resume. Additionally, the hacker’s email address matched one linked to a known North Korean hacker group.
Kraken discovered that the email associated with the malicious candidate was part of a larger network of fake identities and aliases. One of these identities was a known foreign agent on the sanctions list. To further investigate, Kraken's security and recruitment teams subjected the hacker to multiple rounds of technical information security tests and verification tasks. These tests were designed to extract key details about the candidate's identity and tactics.
During the final round of the interview, Kraken set traps for the hacker. The candidate was asked to verify their location and recommend local restaurants, which they struggled to do. This basic verification test revealed that the candidate was not who they claimed to be. Nick Percoco, Kraken’s chief security officer, emphasized the importance of vigilance, stating, “Don’t trust, verify. State-sponsored attacks aren’t just a crypto, or U.S. corporate, issue – they’re a global threat.”
This incident highlights the evolving tactics used by state-sponsored hackers to infiltrate companies, particularly in the cryptocurrency industry. Kraken's proactive approach in identifying and exposing the threat actor demonstrates the importance of robust security measures and continuous vigilance in protecting against such attempts. The exchange's decision to engage with the candidate to gather more information underscores the need for thorough verification processes in the hiring of sensitive positions.
