Threat Landscape Update: North Korean IT Workers, OSINT, and Remote Monitoring and Management Abuse
2025-01-08 • Microsoft •
https://thecyberwire.com/podcasts/microsoft-threat-intelligence/35/notes
Microsoft Threat Intelligence Podcast guests discuss abuse of remote monitoring and management tools alongside North Korean IT worker fraud. The RMM section covers ScreenConnect-style access used by criminal and nation-state actors for malware delivery, AsyncRAT, ransomware, phishing, and tech support scams. The DPRK section says North Korean workers pose as legitimate coders, infiltrate organizations, steal cryptocurrency, and have contributed to more than $3 billion in theft since 2017. The episode frames both issues as access-abuse problems that can expose financial services and other high-value targets.