North Korean IT worker schemes exploit onboarding security gaps

The FBI has warned that North Korean IT workers are exploiting gaps in onboarding security by using fake or stolen identities to secure remote roles at companies, gaining legitimate access to corporate networks. These attacks bypass Zero Trust measures by targeting points where trust is established for new hires, before strong authentication is in place. The agency recommends robust identity verification not only for access, but also during the hiring process and remote employee onboarding.

• North Korean attackers use false identities for onboarding
• Fake workers pass hiring, gaining real accounts
• FBI urges strong initial and ongoing identity checks
• Onboarding is a prime target for social engineering
• Credential bootstrapping exposes enterprises to attacks