A Case of When the Hunter Becomes the Hunted

What if the biggest threat to your organisation doesn't break through the firewall? What if you hire them instead? That was the fascinating twist in a recent cybersecurity investigation where researchers created a fake cryptocurrency start up, advertised developer positions and ended up hiring three people they suspected were North Korean IT operatives. The interesting part? Nobody hacked their way in. They applied for a job. They passed interviews. They provided identification. They signed contracts. And they received legitimate access to corporate systems. The front door wasn't broken. Someone simply opened it. And that got me thinking about how most organisations approach security. The CV looked fine. The behaviour didn't. The researchers reportedly uncovered inconsistencies during the hiring process. One applicant claimed to be based in Texas but provided a California driving licence and a New York bank account. Another provided a Texas licence, a valid Social Security number and a bank account in Kansas City. Another reportedly submitted a New York licence belonging to someone else. Individually, some of these things might be dismissed as administrative oddities. Together, they start telling a different story. And this is where cybersecurity needs to borrow something from investigators: Don't just look at what someone tells you. Look for whether the evidence agrees with the story. A CV tells you who someone says they are. A background check tells you what can be verified. But behaviour tells you what they're actually doing. That's where the real security story often begins. The first day was more revealing than the interview Once onboarded, the workers were given virtual machines. The researchers could see their activity. The machines were reportedly fingerprinted almost immediately. System information was gathered, network locations were checked and remote-access software was installed. One individual reportedly connected a personal Google account to the machine, giving access to browsing history, saved passwords and browser extensions. They also logged into GitHub. Again, none of these actions individually screams: "CALL THE SOC!" But cybersecurity isn't always about one giant red flag. Sometimes it's about several small flags appearing at the same time. And that's where continuous monitoring becomes critical. Lesson 1: Don't just verify the employee. Verify the behaviour. Employee verification shouldn't end when HR says: "You're hired." For security teams, the question should evolve from: **_Who is this person? to: Does this person's behaviour make sense for who they claim to be?_** Does their location make sense? Does their device look normal? Are they accessing systems relevant to their role? Are they suddenly using remote-access tools? Are they connecting personal accounts to corporate devices? Are they authenticating from multiple locations? Are they accessing data they have never needed before? None of these automatically makes someone malicious. But they can become valuable signals when correlated. Lesson 2: Zero Trust isn't "Trust Nobody" — it's "Keep Checking" This is where Zero Trust becomes more than another cybersecurity buzzword. Getting authenticated should not mean getting unlimited trust. A user may legitimately have access to GitHub. That doesn't mean they should have access to every repository. A developer may need access to a development environment. That doesn't mean they need access to production. An employee may need administrative privileges for a specific task. That doesn't mean they need them permanently. Access should be based on identity, device, context, role and risk — and continuously evaluated. Because the moment an attacker obtains a legitimate account, traditional perimeter security starts losing its advantage. The attacker is already inside. Lesson 3: Sometimes the best detection is prevention We love talking about SIEMs, EDR, threat intelligence and detection rules. And rightly so. But sometimes the best alert is the action that was never allowed to happen. If a developer doesn't need remote-access software, don't allow it. If a user doesn't need administrative privileges, don't give them. If an account doesn't need access to sensitive repositories, restrict it. If a device doesn't need to communicate with a particular service, why should it? Least privilege reduces the blast radius. Detection tells you something went wrong. Good security architecture can make sure there's less damage when it does. Lesson 4: The SOC needs context, not just alerts Imagine your SIEM generates these events: User logged in from unusual location. Remote-access software installed. System discovery commands executed. Personal account connected. Sensitive repository accessed. Five separate alerts. Or one investigation? That's the difference between collecting logs and understanding behaviour. The real value comes from connecting the dots. A modern security operation shouldn't only ask: "What happened?" It should ask: "Does what happened make sense?" The Bigger Picture The suspected North Korean IT worker campaigns are a reminder that the attack surface doesn't begin when someone connects to your VPN. It can begin during recruitment. It continues through onboarding. It follows the employee throughout their time in the organisation. And it doesn't disappear simply because they passed an identity check on day one. For me, the biggest lesson is simple: Identity is not trust. Authentication is not trust. Employment is not trust. Trust should be earned, limited and continuously evaluated. Because sometimes the person you're trying to keep out isn't standing outside your network. They're sitting inside it. With a legitimate account. Using a legitimate laptop. Doing a legitimate job. And that's when the hunter becomes the hunted. A few questions for the security community: How much should cybersecurity teams be involved in employee identity verification? Should behavioural monitoring become a standard part of the employee lifecycle? And where do we draw the line between security monitoring and employee privacy? I'd love to hear how other security professionals approach this. Cybersecurity #ZeroTrust #InsiderThreat #CyberSecurity #ThreatDetection #SOC #IdentitySecurity #SIEM #CyberThreatIntelligence Story culled from The Hacker News