{"id":65212,"date":"2022-08-02T10:39:11","date_gmt":"2022-08-02T07:39:11","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=65212"},"modified":"2025-09-06T18:44:30","modified_gmt":"2025-09-06T15:44:30","slug":"bloomberg-north-koreans-plagiarise-linkedin-resumes-to-earn-bitcoins","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/bloomberg-north-koreans-plagiarise-linkedin-resumes-to-earn-bitcoins\/","title":{"rendered":"Bloomberg: North Koreans plagiarise LinkedIn r\u00e9sum\u00e9s to earn bitcoins"},"content":{"rendered":"

North Koreans are plagiarising online r\u00e9sum\u00e9s from legitimate LinkedIn and Indeed profiles to obtain jobs in U.S. cryptocurrency companies. reports<\/a>, citing security researchers from Mandiant Inc.<\/p>\n

Typically, North Koreans attribute specialisation in the technology sector and experience in software development. They actively engage on GitHub, learning about the latest trends in the crypto sphere.<\/p>\n

Researchers from Mandiant reported CVs from North Korean residents in which they published a white paper for the digital currency Bibox or presented themselves as senior software developers at a blockchain-focused consulting firm.<\/p>\n

Experts identified on employment sites several suspected North Koreans who were hired as contractors. They declined to name employers.<\/p>\n

Pretending to be from other countries, North Korean residents seek remote work in crypto firms to earn money or launder funds for the sanctioned government, say Mandiant.<\/p>\n

The North Korean government denies involvement in any cyber theft.<\/p>\n

In April, Aztec Network CEO Jonathan Wu described being \u201ca little shocked\u201d by his interview experience with a potential North Korean hacker.<\/p>\n

\n

\u201cIt\u2019s scary, funny, and a reminder that you have to be paranoid and triple-check your methods OpSec<\/span>,\u201d he wrote<\/a> on Twitter.<\/p>\n<\/blockquote>\n

Among the techniques employed by suspected North Korean hackers is the launch of a fake Indeed.com site to harvest information about its visitors, Google Alphabet Inc. reports. The attackers manipulate job seekers into submitting r\u00e9sum\u00e9s, to later hack their computers or steal data.<\/p>\n

Google data show hackers also spoofed domains such as ZipRecruiter, Disney\u2019s job page, and Variety Jobs.<\/p>\n

In February, the security firm Qualys Inc. said it uncovered a phishing campaign in which the North Korean Lazarus Group targeted job candidates at Lockheed Martin Corp.<\/p>\n

Hackers sent messages purportedly from Lockheed Martin, attaching malware. In a similar fashion, they impersonated BAE Systems Plc and Northrop Grumman Corp.<\/p>\n

According to Mandiant, North Korea has focused on stealing cryptocurrency after years of attacks on the global financial system.<\/p>\n

\n

\u201cThe market has changed, banks are safer, and cryptocurrency is a completely new frontier. We\u2019ve seen them pursue end users, crypto exchanges, and now crypto bridges,\u201d said the analysts.<\/p>\n<\/blockquote>\n

The evidence uncovered by Mandiant supports the accusations made by the U.S. government in May.<\/p>\n

As noted, the Treasury, the State Department and the FBI issued a warning document<\/a> about North Korean IT specialists taking freelance roles in various tech, including cryptocurrency projects.<\/p>\n

U.S. authorities say North Korea earns income through such staff, which it directs toward financing weapons programmes.<\/p>\n

Read ForkLog\u2019s Bitcoin news in our Telegram<\/a> \u2014 crypto news, prices and analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"

North Koreans are plagiarising online r\u00e9sum\u00e9s from legitimate LinkedIn and Indeed profiles to obtain jobs in U.S. crypto firms.<\/p>\n","protected":false},"author":1,"featured_media":65213,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,1523,1202],"class_list":["post-65212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-linkedin","tag-north-korea-dprk"],"aioseo_notices":[],"amp_enabled":true,"views":"16","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/65212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=65212"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/65212\/revisions"}],"predecessor-version":[{"id":65214,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/65212\/revisions\/65214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/65213"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=65212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=65212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=65212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}