American technological company Cinder collided with an unusual problem. In their database of candidates for vacancies were North Korean engineers, who are supposed to work in the interests of the DPRK government.
Such cases are becoming increasingly common among American companies that hire employees for remote work. North Korean engineers, being, for example, in China, are trying to get posts in American companies to earn money for the DPRK, working under other people’s names.
Cinder notes that North Korea has long been sending its citizens abroad to earn money, which then goes to the state treasury. Such employees are required to perform wage quotas, a significant part of which is at the disposal of the government. To prevent escape, the families of employees remain in North Korea as “hostages.”
The situation was aggravated after the Covid-19 pandemic, when the number of vacancies with remote work has grown sharply, especially in the technological industry. Many DPRK engineers are attracted to high salaries in the United States, which can be several times higher than their monthly quotas. Former North Korean businessman Hyun-son Lee said that a quota for an IT worker from the DPRK working in China is about $ 6,000 per month, and many companies in the United States can easily cover this amount.
Cinder, whose founders are former CIA employees, was able to quickly recognize and neutralize the threat. Cinder leaders previously worked on cybersecurity and human rights issues in North Korea, which helped them quickly identify suspicious candidates.
One of the founders of Cinder noted that the work in the CIA helped the company to recognize the methods of work of North Korean specialists. Candidates suspected of working for the DPRK often did not have a presence on the internet outside corporate networks, used recently created profiles and changed (or generated by AI) photographs, and were also poorly oriented in technologies and locations that were indicated in their resumes. Additionally, such candidates showed strong unwillingness to go on business trips and adhered to prepared answers to questions.
Cinder began to more carefully check the candidates using additional methods of analyzing their work history, profiles on social networks, and behavior in interviews. Despite this, sometimes suspicious candidates still reached the interview stage, where their deception was revealed during the process of communication. In one of these cases, the candidate, upon learning that Cinder customers are investigating state espionage, abruptly ended the Zoom call and did not respond further.