{"id":89051,"date":"2025-09-18T16:12:34","date_gmt":"2025-09-18T13:12:34","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=89051"},"modified":"2025-09-18T16:16:33","modified_gmt":"2025-09-18T13:16:33","slug":"cz-warns-of-imposter-employees-threat-from-north-korea","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/cz-warns-of-imposter-employees-threat-from-north-korea\/","title":{"rendered":"CZ Warns of &#8216;Imposter Employees&#8217; Threat from North Korea"},"content":{"rendered":"<p>North Korean hackers are &#8220;advanced, creative, and patient,&#8221; stated former Binance CEO Changpeng Zhao (CZ). He highlighted the current threat of their infiltration into companies.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">These North Korean hackers are advanced, creative and patient. I have seen\/heard:<\/p>\n<p>1. They pose as job candidates to try to get jobs in your company. This gives them a \u201cfoot in the door\u201d. They especially like dev, security, finance positions.<\/p>\n<p>2. They pose as employers and try to\u2026 <a href=\"https:\/\/t.co\/axo5FF9YMV\">https:\/\/t.co\/axo5FF9YMV<\/a><\/p>\n<p>\u2014 CZ \ud83d\udd36 BNB (@cz_binance) <a href=\"https:\/\/twitter.com\/cz_binance\/status\/1968533125929058454?ref_src=twsrc%5Etfw\">September 18, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The former head of the exchange noted that he personally encountered or heard of such situations. North Korean hackers pose as job candidates to secure positions in companies, which &#8220;opens doors for them.&#8221;<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;They particularly like positions in development, security, and finance,&#8221; CZ added.<\/p>\n<\/blockquote>\n<p>Additionally, North Korean hackers disguise themselves as employers, attempting to conduct interviews or offer jobs to employees of other firms, the businessman continued. During interactions, they &#8220;experience Zoom issues&#8221; and send a phishing link for an &#8220;updated meeting.&#8221;<\/p>\n<p>Other covert agents ask employees coding questions, later sending them a malicious &#8220;code sample.&#8221;<\/p>\n<p>CZ mentioned instances where hackers contacted support services pretending to be users, trying to lure them to a compromised site.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;They bribe your employees and outsourcing providers for data access. Just a few months ago, hackers breached a major Indian outsourcing service, resulting in a data leak from <a href=\"https:\/\/forklog.com\/en\/news\/revised-lawsuit-reveals-details-of-coinbase-hack\">a major American exchange<\/a>, leading to asset losses exceeding $400 million. The list goes on,&#8221; Zhao wrote.<\/p>\n<\/blockquote>\n<p>He advised all crypto platforms to &#8220;train employees not to download files and to scrutinize candidates more thoroughly.&#8221;<\/p>\n<h2 class=\"wp-block-heading\"><strong>&#8216;Security Alliance&#8217;<\/strong><\/h2>\n<p>In his post, CZ referred to a publication by the company Security Alliance, which compiled a portfolio of &#8220;imposter employees&#8221; from North Korea.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">North Korean developers are eager to work for your company, but it&#8217;s important to not get scammed by imposters when hiring. We built this portfolio to help you pick out the right North Korean IT worker for your company. <a href=\"https:\/\/t.co\/3Td2vX4C2v\">pic.twitter.com\/3Td2vX4C2v<\/a><\/p>\n<p>\u2014 Security Alliance (@_SEAL_Org) <a href=\"https:\/\/twitter.com\/_SEAL_Org\/status\/1968396194805088754?ref_src=twsrc%5Etfw\">September 17, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;Developers from North Korea are eager to work in your company, but it&#8217;s important not to fall for scammers&#8217; tricks when hiring. We created this portfolio to help you choose the right North Korean IT specialist,&#8221; cybersecurity experts quip.<\/p>\n<\/blockquote>\n<p>Their website contains descriptions of 62 alleged agents from North Korea. Some have detailed personal information, career achievements, resumes, and interview recordings published.<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"753\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-e39312e3dbc0912c-4592769883309871-1024x753.png\" alt=\"image\" class=\"wp-image-265972\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-e39312e3dbc0912c-4592769883309871-1024x753.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-e39312e3dbc0912c-4592769883309871-300x221.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-e39312e3dbc0912c-4592769883309871-768x565.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-e39312e3dbc0912c-4592769883309871.png 1043w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Source: <a href=\"http:\/\/lazarus.group\/team\">lazarus.group<\/a>.<\/figcaption><\/figure>\n<p>For instance, an individual named Alex Hong applied to nine crypto companies.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-d0cdff531bd40361-4592769870382419.webp\" alt=\"image\" class=\"wp-image-265973\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/www.lazarus.group\/team\/alex-hong\">lazarus.group<\/a>.<\/figcaption><\/figure>\n<p>Previously, ForkLog reported that a North Korean hacker <a href=\"https:\/\/blog.kraken.com\/news\/how-we-identified-a-north-korean-hacker\">attempted to infiltrate<\/a> the ranks of Kraken&#8217;s developers under the guise of an engineering candidate.<\/p>\n<p>In June, the US Department of Justice <a href=\"https:\/\/forklog.com\/en\/news\/us-crypto-startup-loses-900000-due-to-north-korean-infiltration\">charged<\/a> four North Korean citizens with stealing $900,000 from an Atlanta blockchain startup, where they were employed as IT specialists.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>North Korean hackers are &#8220;advanced, creative, and patient,&#8221; stated former Binance CEO Changpeng Zhao. He highlighted the current threat of their infiltration into companies.<\/p>\n","protected":false},"author":1,"featured_media":89052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Researchers compiled over 60 profiles of agents from North Korea.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[935,1111,1202],"class_list":["post-89051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-changpeng-zhao","tag-cybersecurity","tag-north-korea-dprk"],"aioseo_notices":[],"amp_enabled":true,"views":"196","promo_type":"1","layout_type":"1","short_excerpt":"Researchers compiled over 60 profiles of agents from North Korea.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=89051"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89051\/revisions"}],"predecessor-version":[{"id":89053,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/89051\/revisions\/89053"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/89052"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=89051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=89051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=89051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}