North Korean IT Staff Tied to $3M in Illicit Earnings via Stolen IDs

Key points

• IT personnel from North Korea used stolen identities to produce illicit earnings.
• The newsletter ties the activity to $3 million.
• Fortinet and its product line are named; CISA added Fortinet.
• No CVE identifiers were included in the update.
• Severity is assessed as medium.

A newsletter has been released describing how IT personnel from North Korea used stolen identities to produce illicit earnings. The reported total is $3 million. No CVE identifiers are attached to the item, so this is not a patch-now vulnerability report; it is an identity-fraud and insider-risk warning.

Fortinet and its product line are named in the newsletter, and the Cybersecurity and Infrastructure Security Agency added Fortinet in the same update. Because no CVE is cited, defenders should not wait for a patch trigger. The relevant controls are identity proofing, contractor oversight, and vendor-risk review.

The people most exposed are organizations that hire remote technical contractors and rely on uploaded documents or self-attested credentials. Stolen identities can pass superficial checks, giving an attacker a legitimate-looking account and payment path. The $3 million figure indicates a financial motive, not just espionage.

For public-sector and education IT teams, the practical impact is in hiring and account lifecycle management. A contractor account that looks valid can still be fraudulent. Teams should verify identity through live interaction, confirm work history, and separate payment approvals from account provisioning.

What to watch: follow-up from the newsletter, any additional CISA or Fortinet guidance, and patterns of identity fraud in remote IT hiring. With no CVE to track, monitoring should center on anomalous contractor behavior, banking changes, and privilege creep. Severity is medium.

What to do now

1. Re-verify every remote IT contractor with live video, government-issued ID, and independent work-history checks; do not accept uploaded documents alone.
2. Audit contractor accounts for least privilege, MFA, and separation from administrative roles; disable unused accounts promptly.
3. Require dual approval for contractor bank-account or payment-detail changes and review payroll exceptions.
4. Review Fortinet product access and admin logs for unusual activity; validate any vendor communication through known channels.
5. Subscribe to CISA and Fortinet advisories and the newsletter follow-up; track identity-fraud indicators even without CVEs.
6. Brief HR and IT hiring teams on stolen-identity red flags and establish a fast escalation path.
7. Map remote IT hiring workflows to identity-proofing controls and document exceptions for audit.

Original source

Security Affairs