Ep. 6: The North Korea Model

I don't know if they are telling themselves I started that they are running a legitimate business or they just don't care. It was shock that this is North Korea and I mean they are everywhere. The pressure to meet quotas was much stronger than any ethical concern.

“Honestly I've yet to find a company that has told me they haven't unintentionally hired”

a North Korean IT worker. This is an organizational scale. This is not an individual threat actor or a isolated group. I'm Nicole Pearlroth and this is to catch a thief. Over the course of this season we've watched North Korea infiltrate companies,

Neil Crypto-Currency and build one of the most sophisticated sanctions of Asian operations on Earth.

But money was never the end goal.

It was just a means to an end and to understand that end, I turned to someone who's been studying North Korea's end game closer than almost anyone. I've dated Sanger on the White House and National Security Corps funded for the near times.

“David's a good friend and for a decade he was my reporting partner at the New York Times.”

Together we covered some of the biggest national security stories of our generation, from cyber operations by China, Russia, Iran and the United States to North Korea's attacks on Sony and beyond. And while I was focused on the cyber of it all, David was tracking the other half of the story.

North Korea's accelerating nuclear program and Kim Jong-un himself. Well, Nicole, it's been pretty remarkable when you think about the fact that when Kim Jong-un came in, the CIA assessments were asking questions like, "Could this guy last six months? Could he last a year?" Will the old generals and elders kill him or will they just exile him?

And the first thing he did was consolidate power with a speed that shocked everybody.

It appears Kim Jong-un has purged some of his father's generals. Vice-Marchal Rihong-Hong was often seen alongside the New Leader and then mysteriously fired from all his duties in July of 2012. He began to embrace the new technologies that he thought could make money for them.

“Remember how did North Korea make money before cyber came along as an option to them?”

They counterfeited $100 bills. But the fact that matter is the world moved to a more casual society. And he was actually head of curve here. So we saw Kim move from plain old cyber attacks that were meant to send a message. The Sony hack was the classic example and the one that woke all of us up.

To learning how to steal from central banks, to learning how to get inside crypto currency wallets and drain those out and they've done it time and time again. They've turned sanctions evasion into an art form. But they got so good at it that it's clear that they are becoming a model for other countries.

Ultimately, the money is going to all of his favorite projects.

But his most favorite project are his nuclear weapons projects. If North Korea was going to survive as a global prayer, the regime knew it needed nukes. The ultimate deterrent against the world's superpowers, especially the United States. If the past decade proved out anything, it's what happens to countries when they give up their nuclear leverage.

Celibia. Today, in Tripoli, the leader of Libya, Colonel Wilmore, Al-Qadafi, publicly confirmed his commitment to disclose and dismantle all weapons of mass destruction programs in his country. Today, we can definitively say that the Ghadafi regime has come to an end and one of the world's

longest-serving dictators is no more. We came, we saw, he died, asked for more than 48 years in power. Libya's new leader say, "Momark Ghadafi is dead." "Skeptics once claimed that the nuclear threat would actually grow after the Soviet Union dissolved.

But because of the wisdom and statesmanship of the leaders who joined me here, the skeptics

The document signed by the leaders of Ukraine, Russia, the UK, and the U.S.

“Required Ukraine to give up its nuclear weapons stockpile in exchange, world powers promised”

to respect Ukraine's existing borders and sovereignty. Now we head overseas to the fast-moving changes in Ukraine, signaling the Russians appear to have won this round taking control of their price, Crimea. Russia overnight launched its long anticipated attack on Ukraine, striking military posts across the country.

And then, there's Iran, which signed nuclear deal with the United States, only to watch America walk away, then join Israel and take out its leader and bombing the country a decade later. Over night the U.S. launching strikes on military targets on Cargueland, Iran's main oil export terminal, and with hours to go until his deadline for Iran to make a deal, President

Trump with an alarming new threat, writing, "A whole civilization will die tonight, never

to be brought back again."

“The President addressing the nation after a coordinated attack on Iran, the military operation”

now underway with Israeli forces. Both strikes by Israel and the U.S. hitting targets in Tehran during the morning. After the U.S. and Iran traded strikes this week, the Trump administration asked Iranian officials to publicly state the Strait of Hormuz is open, and its attacks on ships have ended.

The U.S. is blaming the strikes on divisions within Iran's government, initiated by "radicals in their system who are trying to derail the negotiation." Iran says it's not responsible.

Iran also tells us something chilling about North Korea, about why Kim was never going

to stop short of a nuke, because once he crossed the nuclear threshold, the world may

“sanction you, isolate you, threaten you, but it's far less likely to attack you.”

You know, we spent a lot of time discussing Iran these days, but think for a moment about what would have happened if Iran had followed Kim Jong Un strategy and not dilly-dally the round and walked up to the age of building a nuclear weapon, but just went for it. And had obtained one. These days, I imagine Kim Jong Un squirled away in one of his private residences, billas,

or fortified compounds, watching the strikes on Iran thinking, "I've done it right." And some ways the West just spent the last 20 years validating North Korea's nuclear strategy. Give 'em up, and you might pay a price. President Trump called me to talk about the Iran deal with he had just signed. And I said to him, "If I was the Iranians and I drew a lesson from this, the lesson I

think I would have drawn was the North Koreans got this right." And if I was an Iranian, we just survived this war. I probably think it's time to follow Kim Jong Un strategy. But the fact matter is, they now have 60 or more nuclear weapons. Some analysts think it's probably closer to 100, which would put them at comparable to

the arsenals of Pakistan and Israel. And that's where the money's going. It's not going to social welfare programs to feed these people. Yes, the weapons program gets the lion share, but not every stolen dollar ends up in a missile silo.

Munitions get priority funding, but Kim Jong Un has another line item. His toys. Bulletproof stretch limos made by Mercedes and Rolls Royce worth about $500,000 each. There's nothing for Kim Jong Un quite like a ride on a white stallion on a revered mountain top as a means of inspiring his people. Pyongyang's state run news agency released

several photographs of Kim riding the galloping horse, a top North Korea's highest peak the volcanic mount pectu. Experts say Kim also spends the money on luxury goods for himself, for his glamour conscious wife and his cronies, a private jet, an exclusive ski resort, and a polished white yacht.

That Kim's top priority has always been his nuclear arsenal, and year after year, will

the world was focused elsewhere, North Korea kept advancing, right under our noses. You know, one of the things that astounds me in this job is that Donald Trump did not raise the alarm about North Korea, he's barely talked about North Korea, and every time he

We got along great.

I know him better than you do.

I know him better than anybody, almost. You know, I'm not supposed to say I really like about a lot, because if I do that, I get killed in the fake news media, but I got along with it very well, and we had no problem. But relationships aren't disarmament, and neither is our intention, and will Washington moved on to Iran, to Ukraine, to China, to whatever crisis was breaking that day.

North Korea kept building. Not suddenly, not secretly exactly, but in the space created by our assumption that this is still a backward isolated country, we can afford to underestimate. It tells you how much the North Koreans rely on us thinking about them as a background towards society, who's people are eating grass, because they've got nothing else and where

the smoke stacks are all silent, as they were when I was in North Korea and what 30 years ago. But wasn't for nuclear weapons?

“How much thought would we all give every day to North Korea?”

Not much.

Second, if we had a state like North Korea, that was helping the Russians cleaning out

cryptocurrency wallets. Engaging in high-scale cyber fraud, conducting operations like Sony, but that it didn't have nuclear weapons. Do you think that we would be treating them with such kid gloves? I don't think so.

When I first started digging into North Korea's IT worker scheme, there was an odd comfort in believing these workers were mostly there for the paycheck. Yes, the salaries still funded North Korean nukes, but at least the workers themselves didn't appear to have a more destructive mission.

“At least that's how investigators understood it then.”

Here's Mandian's Chief Technology Officer Charles Carmichael.

My initial assumption was that these actors had to have been doing something malicious. We knew that they had access to production code, production systems. We knew that they had the ability to insert back doors into a variety of things. And we very deliberately looked for evidence of that malicious activity. And we found none of it over hundreds of investigations.

And what we assessed was that these actors are just collecting a paycheck. But as more companies grew wise to the scheme, they've started hunting for North Koreans and their workforce, and the good news is they're finding them. Companies are starting to look for signals we've surfaced throughout the series. In consistent identities, coached interviews, strange log-in patterns, laptop farms,

elasmine, a change of address, key stroke latency, and workers who don't quite match the person they claim to be on camera. And that is where Rob Joyce, the former head of NSA cybersecurity directorate, told me defenders may actually be reclaiming the advantage. I actually think the North Korean problem is much more solvable than the generic intelligence

asset deployed into a company. Why do I say that? Because these are all remote workers. So I was at a conference just this week where people were talking about the tools they've enacted to stop remote workers from getting into their employment chain.

They're doing things like taking a picture on the video interview, and then using that when the person shows up and is online at work to see if they've changed in any appearance or haven't kept a consistent story. Others are insisting on a one week onboarding where you come in. And you've seen things like technical capabilities looking at the latency of keystrokes.

“So the fact that their remote workers is a reliability, and I think the industry will adapt”

and get much stronger at detecting and preventing this. At companies across America, cybersecurity teams are on the hunt for red flags and behavioral tells, but as companies screen for these red flags, North Koreans are landing fewer jobs, companies who hired them are firing them faster, but the quote is remain, and so do the regime's financial expectations.

The punishment for workers who fail for their families is still there, and that's where the danger lies, because if the paycheck disappears, something else will have to get monetized,

Here's Charles again.

“Things changed in 2024, as more and more companies disclosed that there were North Korean”

IT worker problems, and as companies became more aware of the problem, they started doing a much better job of blocking and finding these North Korean IT workers. And so the problem for the IT workers is that years ago, they would hold a job for a year or two years. And they would have multiple jobs.

Now, we're in the second half of 2024, they struggled to hold jobs.

They might have gotten a job for a few days, and then somebody noticed that something was going on, and then they were terminated. And so they needed to find a way to supplement their income. And for a very small number of our cases, under a dozen, we saw that there was some element of extortion by the North Korean IT worker.

The individuals who were terminated would tell their supervisors that if you don't pay me my son-in bonus, I'm going to take all this data that I got access to through my job, and I'm going to publish it on the internet. We didn't actually see the publication of the data, but we saw the threats fast forward. We saw more and more aggressiveness by these IT workers demanding money.

In the most egregious case that we saw, we saw a brand new persona sent emails to a number

of victim organizations saying, "I've hacked into your network, I've stolen your data.

Here's a sample of the data that I stole." And in those investigations, what we found was that sample of data exactly matched the information that I suspected North Korean IT worker had taken six months prior. Now, from our perspective, it felt like these individuals were learning at extort companies. That last line is one that should make every company sit up, because this is no longer

just about North Korean workers collecting salaries under false pretenses. It's about the data and access they gain along the way, and what happens to it when the like lapses. By the end of 2024, we knew about hundreds of Fortune 500 companies that had unintentionally hired in North Korean IT worker, where they lost a fair amount of data, because these employees

once they were caught, they didn't return their laptops in most situations. They kept their laptop at whatever data that they needed, so that data was out the door of Scott, and our fear was, throughout 2025, possibly some of the data that was taken could show up in the future.

“Could this data be used to facilitate future attacks?”

It absolutely could be used. For years, there seemed to be a clear division of labor. The IT workers earned money, the hackers stole it. But by 2024, that line had blurred. Future start catching hand-offs between the IT workers and the elite hacking units.

The walls were breaking down. Not all IT workers can be hackers, every hacker at any point can be an IT worker, and that's a very important thing because we've seen them interchange at times. That's Barney. AKA Michael Bartonhart, detects his lead insider intelligence analyst.

He admits that this overlap makes it harder to track their ever-evolving strategy. I want them to be in tiny, little, beautiful buckets, and I can just be like this when there's this and this, but that's by design too. Now the thing that's very interesting is for the IT working force, there are several levels. You've got your IT workers that are just completely revenue generation and they're like

very low level, like it's like slave labor, the human rights elements for them is really, really, it's terrible. And then you have your more elevated ones.

The elevated ones always seem to be on those crypto units and it's interesting because

they get certain privileges. The IT workers that are embedded with the actual hacking groups, or at least assigned or associated with them, are very interesting. What Barney started seeing in 2024 set off alarm bells. For the first time he was catching communications between North Korea's remote IT workers

and he'll be hacking units, he'd spent more than a decade tracking. Groups like endereal, the hacking unit behind Sony and ransomware assaults on U.S. hospitals, and trader trader, the North Korean crew behind Bibet and the crypto ice, they were talking. It's something that blew my mind because we've started seeing IT workers in their operations

and DRL should not be talking to the IT workers and I remember just sitting and like what is going on here? Like, is this wrong? What is this? And you start peeling the onion back and you say, oh, all these other accounts are

all IT workers. Oh, these are all the hacking group.

“And I'm like, okay, so they're just with them, right?”

No, they're actually helping them with operations.

working teams and helping each other.

“And that's when I'm like, okay, we need to sound the alarms bad.”

The problem was, at that time, it was very sensitive and sometimes classified. So we had to wait like a year and a half until we'd actually see this stuff happening out in the open, and then we're like, now this is actually coming to light. We can start talking about this more, but once we did, it was just banging on the trash canlets.

Hey, everyone. Because that's when people started to take note, like, hey, they're not just revenue generation. And then suddenly, it's almost like this and DRL group was like, hey, we want to get into all these organizations. We have IT workers at these organizations.

Why are we not abusing them? Let's use them as the human vector.

They were the first to do it, and now you see all the other groups doing similar things

to leverage that. He workers in a malicious way. So they're watching what they're doing.

“Barney isn't being hyperbolic here, just remember what the North Korean defector told us.”

Chon Ki-gang, Si-wane, and Bolden Kompatoi, computers had monitoring software installed. And a supervisor lived on site with those while continuously observing activity. All that information is going back to the Ministry of State Security, program managers, his overlords. There's also cameras all around the rooms, too. Now remember these hacking groups, they're now managers for these teams, so they're watching

in the background. He's like, hey, I want you to come over here and look at what this one's saying. Look at what he's doing right here. We could use this. The hacking group is taking the information from the IT worker to weaponize it against

XYZ or thereafter. This is the nightmare collaboration. The workers get inside, but the hackers inherit their access. And the threat doesn't stop when companies fire these workers, long after they're fired, the possibility for damage remains.

Here's Charles again.

“They don't forget about the data that they've stolen in the past.”

They don't throw it away. They keep it. They leverage it. They come up with really creative ways to use it down the road. So information that we've seen stolen years ago, anticipate, seeing being used by the adversary

years from now, they will continue to build upon the information, the infrastructure, the access that they've gained over the years. One of the challenges investigator space is something John Holtquest, who leads Google threat intelligence, calls the soda straw problem. It's something I faced as a journalist in this space, too.

When you look down the whole of the soda straw, you only see a tiny slice of the world around you in any given moment. We're lucky to catch one attack, but by the time the full picture of a campaign comes into focus, years have passed. The data's gone, the intellectual properties gone, the access has already been established.

And only then does the full motive become clear. We have to recognize that we have limits here. There is a lurking risk that we have to be very clear about. And so I fully suspect that if they are in the right system, that they're going to do a hand off or at least capture that data and pass that alone.

And even if we haven't seen it, we have to recognize that we have limits here. I have to believe that this group is not so insulated that they can't bother to pass things back. Or it's right. There's something of value, it can't believe in a state like North Korea.

You're not under some kind of very serious order to not pass something that you think is of value to the regime. At the end of the day, these workers aren't just workers. They're foreign operatives working at the behest of an adversary. In a hacking context, the IT workers' data day is reconnaissance.

The data they glean, the source code they access, even build in some cases.

It's exactly what hackers seek in the first half of the kill chain.

The expiltration or detonation might not come until later, but we have to assume it will come. Here's Rob Joyce again. They are going to turn that insider access from a revenue paid cell rate position into the insider threat position, so an employee can become a foothold to follow on operations.

And as we've learned, these IT workers, they're everywhere. Here's Barney again. They have placement access globally, I mean, they are everywhere. Have they ever done it? Has an IT worker ever done it?

Yeah, they've done destructive attacks, they've done stuff on the inside, so really what we have now is a worldwide chess game, and they've put all their pieces in place.

And they're not really in an armed conflict right now, I know they're always kind of fighting

at your disposal that you can start blowing up from the inside.

“Listening to Barney, I couldn't help thinking back to our first season.”

Then we were talking about Chinese hackers quietly prepositioning inside America's infrastructure. Now we're talking about people, people with legitimate jobs, credentials, real access,

to source code, the Crown Jewels, are most critical infrastructure in some cases.

I mean, for Heaven's sake, don't forget we found one of these North Koreans working at a US nuclear utility. And this may actually be the more insidious form of prepositioning. Here's David Singer again. For the IT workers, there's no greater sort of way to break into a system than to have somebody

in there who's got legal access already. It's the same reason that the Soviets used to try to put spies inside the CIA and the counterintelligence operations started, because computer systems are dynamic, and the employees are likely to have access to the most up-to-date passwords that will understand the system's better, so this was a really smart strategy, and one of the things that actually most strikes

me is that the Chinese, as far as we know, have not replicated it yet, but somebody will.

That's the part that should give us all pause. North Korea built the playbook, but they're no longer the only ones using it. Here's John Holkwist again. There's ample evidence that this insider risk thing is definitely not just the North Korea problem, right?

I think they let's say they scaled it up, they industrialized the insider risk problem.

“But I think it'd be wacky to assume that they're the only ones doing this stuff, right?”

There are so many countries where they have a strong interest in placing insider's, the organizations all over the world, that's been going on since, I don't know, since there were city states in the middle of the desert, the height of civilization. North Korea is proven to tell the organizations around the world that it's very possible to gain access this way, so for high value targets, the insider risk is stronger than

heaven. I think that we went to this period where we just kind of forgot out of that people. We increased remote work at the same time, decreasing, vetting people, and other respirators asked her. I think this from all this is, I think we've had it revisital on in this broad census.

But if that's the good news, here's the bad. North Korea's playbook, it's spreading with a troubling twist.

“I thought stories about North Korean IT workers were pretty extreme, and it's gotten weird”

because it's actually happening in person, in country. That was Ryan Lassal, CEO of Miso's, who by now should sound familiar.

It's been four years since Niso's answered that first call from a Fortune 500.

But today, after a steady stream of these infiltrations, the calls have changed. Niso's is increasingly being asked by companies and their investors to vet new hires at the front door, not just investigate them after the damage is done. And what they're finding sounds a lot like deja vu. So we help one of our clients that all their employees.

And in this case, they had another one of these recent hire, something seemed off about it. Their spotty sense was tingling, they didn't know what was going on, and we were doing the diligence anyway. When we looked into the person, they had a long history in the U.S., but they'd actually come from Iran.

There's a lot of people in the U.S. working who have come from Iran and bringing great talents to the country, this person, however, had a weird gap in their life. There were some gaps in their education, there's some gaps in their work history, essentially disappeared from the world for about nine years. And all the digital trail went cold.

And it was not even clear that their name was the same earlier in their life. As it was later in their life, we came back to them and said, "Okay, their work history in the U.S. checks out, before they got to the U.S., there's a nine-year gap that we can't attest." They said, "Thank you very much."

They went and took that to some of their partners in law enforcement, and the U.S. government helped them figure out what that person was. The U.S. government, looking at it, said, "Oh, this guy is actually an IRGC plant, an Iranian plant in the U.S., we need to get him out of the country, and they expel him in the country." As Iranian spy wasn't just working for any old company, they infiltrated a startup

that was based in the U.S. was actually run by people from Israel, Iran's key adversary.

into the U.S. and globally, and they're having to think really hard, who are they hiring

“and the people that they're bringing in who may actually want to do them harm because of”

who they are and not because of what they do. In this one Iranian spy, he wasn't the only one they've found. Two times now, for one company, we found IRGC plants, the Iranian guard, core, the hard liners who are running in the country, putting plants inside those companies. Two suspected Iranian operatives trying to land jobs at the same company, in the span of

a single year, a company that knew to ask the right questions, calling the right investigators, had connections to law enforcement. Now, zoom out, think about all the companies that don't share that same level of paranoia, or their connections. The real question now is how many of these plants are still inside.

But unlike North Korea, Iran isn't primarily motivated by revenue, if its previous attacks are any indication, its primary motive isn't just espionage, its retaliation, and destruction.

“Also blamed on Iran, recent hits on Saudi Arabia's state oil company, Aramco, and Qatar's”

natural gas producer Raskas, that disabled 30,000 computers entirely. Iran and his learned thousands of employees at Sans Casinos in Las Vegas and Bethlehem Pennsylvania had their computers hit. Iran is suspected to be behind the attack. Iran has a long history of destructive cyber-attacks, Saudi, Ramco in 2012, Sans Casino,

in 2013, to an attacks that paralyze these companies. In this year, Iran's hackers resurfaced with the same destructive playbook. This time aimed at a major US medical equipment company, Strayker, a massive cyber-attack, knocking out the network for medical device-maker, Strayker, disrupting services across company devices, a pro-aronging and hacker group took to social media to claim credit for

that attack. This was a devastating attack.

“I spoke to a Strayker employee who tells me they watched some of their computers and”

iPhones get wiped out by hackers in real time, all that data gone. The IT worker playbook looks very different in Iran's hands. And what's troubling is that investigators are starting to see North Koreans actually recruit Iranians to their IT worker scheme. Here's Barney again.

Even in some of the recruitment pitches that you see North Korea doing, they actually have the targets where they talk about, "Hey, we're both sanctioned, we're both in this struggle bus together, I need money, you need money, why don't we work together and in the direct collection efforts that we see across our partners?" They're saying it to Iranian facilitator this.

Iranian facilitator that it could be a laptop farm, it could be a night identity brokerage, but you are seeing groups that North Korea igniting the criminal underworld at times. Even the Nigerian print scammers are at it. They're all borrowing the model now. Cybercrime groups, not in North Korea, are like, "Oh, wow, that's smart.

Let's start doing that." Absolutely, we've got North Koreans using Nigerians as their subcontractors. We've also got Nigerians just been like, "We're going to do this ourselves." So again, the Nigerian print scam that came back, it's almost like he's back. He's back and he's got all this friends here to work with us now.

The problem is is that they're adapting anything that we do, the criminals are adapting

so quickly, so by the time you get information out, by the time this comes out, they're going to be doing something even different. North Korea will indefinitely listen to this podcast or get the report and it comes off in adapter tactics. North Korea industrialize the IT worker model, but pulling this off still requires people

and manual labor. A elaborate fake identities are hard to craft, passing a screening interview, takes time, technique, and tact. Charming laptop farmers, recruiting Americans to show up for your drug test, it's a tough gig to say the least.

But for some, writing convincing English is challenging, until now. Artificial intelligence has helped cyber-graphed reach new heights. AI didn't invent this playbook, but it removes almost every obstacle to running it. And if it isn't abundantly clear by now, North Koreans aren't just early adopters, they're pioneers with crypto and now AI.

Here's John Holkwist again.

Interestingly, they were like the early adopters of AI because the first applications

What it was very good at at the beginning was fabricating content, right?

“That's like, you know, sort of off with fake pictures, right?”

And then it was sort of fake text translating things, right? There's a whole family of third party apps that are based on this technology that offer very specific use cases. So we could see them using it to brush up the resume or the cover letter. One of the big ones we could see them use it for was faking identities, right?

As AI has gotten better, we could see them progress from the staff uses to these dynamic uses. So not an image, but a video, right? Not just like a single translated document, but a conversation where they can essentially do multi-turns.

And that's really powerful if your play is social engineering, right?

Because you imagine these guys are from Pyongyang and they're computer nerds from Pyongyang. So they got like two strikes against them. And their job is to go out, pretend to be an eight-shallperson from a California, right? That's a huge lift, imagine if you're like, you know, you live in Pyongyang, your accent would probably be a dead giveaway on some of these scenarios.

So you would use D-Pake Voice to cover that. You know, one of the incidents we'd saw is we could see them essentially use D-Pake

“video to convince a person that they were a cryptocurrency executive, right?”

And so the game is, I think they reached out through a compromised telegram account, sent up a fake zoom call. They get into the fake zoom call. They've got this deep-pake video. And then the play is, there's something wrong with the audio.

Here I'm going to block you through some technical instructions I'd have to fix your audio. There's technical instructions or essentially like malicious instructions. Next thing you know, you've infected your machine. And so the deep-pake stuff is showing up more and more. And we could see them sort of screwing around with it in places like Jim and I, it was

been a huge uplift for their social engineering capabilities. Deep-pakes deserve a moment here. And for that, I'll bring in my friend, honey. I am honey for read. I am both a professor at the University of California, Berkeley, soon to be at Dartmouth College.

And I'm the co-founder and chief science officer over at Get Real Security.

“I focus on authenticating digital media from images to audio to video.”

OK. And not to make you blush, but you're sort of the world's foremost expert in deep-pakes. But you were studying this long before North Korean start using this in interviews. Give us the state of play. Where have the deep-pakes come into play?

So let me tell you some of the things that we have absolutely been seeing. We have seen recordings where it is absolutely a deep-pake where somebody is driving either a new face. I brought to, uh, chin, cheek to cheek of somebody else to conceal their identity. Or they're driving an avatar.

So they're talking in front of a camera and speaking in front of microphone. But what you're seeing is somebody completely different. And we have seen that as well. We at Get Real have seen all of these in various forms. But it's also shifting.

We're seeing the tools get more sophisticated. We're seeing as they get detected, they are adapting. Deep-pakes are showing up more and more. And people are getting savvy to them, like Ilya Krugman, the founder of a Vancouver branding agency who posted on LinkedIn that he was looking for a developer earlier this year.

He hears back from several candidates. One of whom looked perfect.

So he gets on his aim with this guy, Nikodem Blonda, who's young, blue-eyed, and at first

glance, looks Polish. How did you get? All right. Yeah, so what we jumped on didn't get too much of a smile or anything like that was very morose.

Face didn't really move too much. I was like, OK, Eastern European, you know, I'm kind of used to that. I have family in Poland. Uh, and so one of the first things I started with was, oh, you're in Poland. Uh, I was just there, my stepfather's from Vashava.

Oh, really? Oh, you're in Kraków, Warsaw, we went to Bandovo, and then he went to Berlin after. Oh, nice. Um, yeah, I live in Luburin, by the way. The blended.

I loved it. Luburin. Yeah, yeah. Very nice, yes. So tell me, uh, but when talking to him and looking at him,

I didn't really clue in at first.

I didn't think anything of it. It was about a minute and a half or so into the conversation, I asked him, please explain your history and tell me where you've been in your career. Um, so I, yeah, studied at Atos, uh, mostly focusing on the whip, whip development, and also some learning practices.

And then I, after that I joined, you know, Vix, and as he started to speak.

I couldn't put my finger on it at first.

“And then all of a sudden, it dawned on me.”

I'm 90 seconds in as he was telling his whole story. And then I was like, the way he's saying this is kind of weird, like, why is he speaking like an Eastern European? And then I like kind of close my eyes and it dawned on me that this is a pure Korean accent. You can see me laughing in the video.

I'm like, this is, um, this is too comedic, not to ask. Mid interview, Ilya calls it out, but I just stopped for a second. Yeah. Why do you have a Korean accent? In the blink of an eye, the cold drops, Ilya's left smiling with a little shake of

his head. He actually figured out what was going on pretty quickly. He said he'd read articles about North Korean IT workers and after his post went viral, he's been hearing more and more from friends who had experiences with DPRK Deepfakes. My friend, Emily, is a professional recruiter and she told me that they get four or five

of these types of people every week. And they identify them with a tag called FAF, fake as.

The problem is the dead giveaway here, that Korean accent, it's disappearing.

Thanks to AI, freely available tools can now modulate accents in real time. And yes, there are legitimate use cases for this, helping people who've lost their voice, making speech clearer across languages, protecting people from harassment or identification online, but North Korea has found a darker use case. Using AI to sand down the one clue interviewers were trained to listen for and make a

state-sponsored operative, sound like any other remote worker on Zoom. Here's honey again. We've also seen voice modulation, so deepfakes have many flavors. It can be visual, but it can also be auditory. So one of the things that we've been seeing is real-time voice modulation where the accent

can be concealed, so it doesn't have that very strong accent. So the visual is real, but the audio is manipulated.

You know this Nicole, I mean, you've been doing this for longer than I have.

So they're very clever, and they are adapting to the threats and they're adopting the new technology as it's rolling out very, very quickly. Do you know what tooling they're using? Yeah, I'm not going to give you the names of the tools, because you know, that's the best idea in the world, but I'm told they're called voice modulators, and they work in real

time with a few milliseconds delay. So essentially what happens is I'm talking right now into a microphone, deepfake technology grabs that audio, modifies the voice to change the accent or the intonation, and then shoves that into the video streaming, and you can do that in more or less real time with less than 50 milliseconds delay, and there are many, many commercial open source technologies

for doing this. It's called voice modulation. It's very effective, by the way. I have seen some of these interviews, and some of them have even gone viral where it's clear they're using a deepfake, someone says put your hand in front of your face, and

they refuse to do it.

“What point did you discover, oh, they've managed their way around this?”

Here's something very dangerous, I should point out, because I've saw that same viral video, and you saw something, I'll put your hand in front of your face, and it didn't work, and now everybody thinks, oh, just have them wave their hand in front of their face, and now I'm safe, no, no, even if that was true today, it sure is not going to be true three months from now, so I can tell you that the newest technologies for creating

avatar and face swap deepfakes don't work, and the reason they don't work is in the old school deepfake. What the technology would do is simply identify where the fake was and track it over time and either map a new face on or drive another face, and when you obscured the face, the face tracking would get confused, but the new versions are what's called occlusion

aware. They are aware when something is in front of the face, and they simply factor it out, and they can track the face even when something is occluding. If you really occlude the face, really block 80% of the face, it will start to break down, but the hand waving in front of the face just doesn't work anymore.

Okay, we were able to get inside one of these discord channels that this one North Korean cell of 22 people were using to manage their operations, and we would see them say, hey, I can't show up for this interview, can someone else swap in, or I can't show up for this Zoom meeting, I knew to do a consumer swap in, so imagine this is where deepfake technology would be incredibly useful, is that how you're seeing it not just for interviews,

but sort of used in these jobs?

“Yeah, this is really important because there's getting the job, right?”

And in some ways, that's probably easier when I call somebody up to do an interview. I don't know what they look like. I don't know what they sound like. I don't know what time's on their end, but once somebody's been on board, and I've been talking to them for six months, they have to show up for the call, and so now you

other, and absolutely, that's where deepfakes can be incredibly helpful, because I can just change my identity.

“And by the way, there are cross-racial facial identification biases, where within your racial”

group, you're actually pretty good at identifying people, but a cross-racial groups were less good at it. This is a well-established show. You can even see where it doesn't have to be quite perfect, particularly if the quality of the video is not very good, and there's eight people on the call, and your attention

is being dragged across eight different panels. The chance of somebody noticing that, and you step away from the camera a little bit, to make yourself a little bit smaller, you can get away with anything, and so these syndicates if you will. These aren't lone wolves.

These are extremely organized, and when they work together, they're much, much more powerful and dangerous.

“And AI isn't just making North Koreans better liars.”

It makes them better hackers. One of the few areas where North Korea's lag behind the world's top cyber powers, the U.S. Israel, Russia, China, was in discovering brand new software vulnerabilities, and weaponizing them into exploits. The so-called "zero days" that can flip past modern defenses before anyone even knows

they exist.

North Korea's strength has never been cutting edge vulnerability research.

But strength was extraordinary persistence, relentless social engineering, taking known techniques and operationalizing them at scale, but AI threatens to erase that distinction. Here's Broadcombs Eric Chen, whose primary concern now is how AI is erasing the barrier to entry for hackers and nation-seats like North Korea. But that is our worry, when AI shits from being passive to active, and they're at the verge

of it already, and we have demonstrated already with the existing AI, no new technology needed, that we can conduct an attack and to end.

“And I have to type hack-ack-me-cork, maybe three words, right?”

And that could happen. That is our worry with AI, when it becomes very active, and the agents become very sophisticated, and then the barrier to entry becomes very low. I don't even have to research and learn about how this thing works. I just tell it to do it on my behalf.

These days, the same frontier models that can generate flawless English, convincing resumes, real-time translation chat bots, they can also analyze source code, uncover vulnerability use, write exploit code, and increasingly, chain those exploits together with little, or in some cases, no human guidance at all.

That's a capability North Korea has never really had, but soon it will, which brings me to

mythos. Anthropic is calling its new clawed mythos, a potential cybersecurity reckoning, saying that the tool can identify, so called zero-day vulnerabilities. Unless you're one of these people who's just buried their head in the sand on AI, you've probably heard about Anthropics newest frontier model mythos, and the controversy surrounding

its exploitation capabilities. This is the latest and greatest Anthropic model, and it is capable of executing not just finding a bug, but exploiting that bug. Going through all the links of the cyber kill chain to successfully execute attack and doing so autonomously.

AI Company Anthropic is withholding the release of its new mythos model, the company says some

of its AI capabilities are too powerful.

Anthropic says its mythos preview presented unprecedented cybersecurity risks. He found thousands of vulnerabilities in every major operating system and web browser. Anthropic made the unusual decision to restrict access because of what the model could do. The US government followed suit by restricting its export, Anthropic then pulled mythos, and another model feeble altogether.

The US government, the Trump administration, has now removed these curves. Anthropics, most cutting-edge models, so faible five, along with mythos five, they will now be, from today, be able to be accessed beyond US shores. So what that means, again, in terms of how Trump administration has gone from very, very less a fair in terms of how they control these models to hang on a second, this is potentially

dangerous potential for these models to escape their guard whales. They appear to now have the Commerce Department in the US, some assurances from Anthropic, to the point where they can remove these export controls that came as such a shock where they came into force in June. And while I have lots of thoughts on how this went down, the relevant point here is that AI

train.

“Mythos won't be the last, soon every friend here model, if they don't already, will have”

mythos as level of exploitation capability, and eventually the open weight models will

too, certainly within a year, months even by some projections. This is the beginning of a new era of automated exploitation, and the capabilities, they're very real. Earlier this year, I sat down with Anthropics lead red teamer, Nicholas Curlini, to understand what mythos can do.

Here's a clip from that conversation. The basic setup is we tell the model we want you to find a bug. This is the code base we're looking at. You have complete access to the machine, go forth, and find something for me. As for what mythos went forth and found, well, most of it still isn't public, because

in many cases, they're still waiting for effects.

“But I asked Nicholas to describe the capabilities in plain English.”

One, most web browsers, on most operating systems, we have full exploits, the kinds of things where you visit a web page, and then the model goes and access to your bank records. You're the kinds of things where on most operating systems, an unclosed user can become administrator. The kinds of things where if you give me your locked phone, I can download the pictures

off of it without unlocking it. These are the kinds of things that we have, which are sophisticated exploits that people use to think of as only the kinds of things that tier one adversaries could build that the model is producing for us.

It's like me and a handful of other people are doing this, none of us who are doing this

are experts in this, and we'd have absolutely no hope we're doing this unassisted, and over the course of a couple of weeks with the model we found dozens of these kinds of things. The remarkable thing about mythos is that anthropic wasn't even trying to build an exploitation model. They trained mythos to write code.

The exploitation only emerges a by-product, but soon, models will be deliberately trained, fine-tune, and finnest for exploitation. And when that happens, every human mistake becomes discoverable at machine scale. Every misconfiguration, every unpatched vulnerability, 24 hours a day, across every time zone without human fatigue.

And no expert control is going to keep that capability out of North Korea's hands. Here's John Holkwist again. Everybody shifts with this stuff. Like the high level guys are going to get even better. The level of the guys are going to be doing stuff that they couldn't do before.

Don't worry that they can shift away from social engineering and start moving into this play where they're focused more on exploits that vulnerability capability, which we've seen North Korea try to get to, but it's been pretty limited. I feel like one of the repercussions of the ways that we're going to see them move is into that space, right?

“And I think North Korea and Iran are potentially on the edge where they can make that shift”

to this higher level of play. And Google, we've had this program called Bixley about, we started about two years ago. And we started using AI to find vulnerabilities. But to me, that was an alarm bell. We got really smart people, but it won't be long before labs are getting set up in Pyongyang

where they're like trying to do the same thing. I believe that process has already begun. We found this year a criminal actor who was using a zero day built with AI. If the criminals are doing it, I'm fairly certain that the states are doing it. I think one of the weird things about this too is that we're not necessarily going to

see the stuff that's going on in Pyongyang, right? We're going to get to see the end result and we may not know that it was created with AI. And so my suspicion is we've already found things over zero days that were created this way. We just don't have the evidence. And here's Rob Joyce, with the lesson we've come back to again and again this season.

The North Koreans think about cyber operations from end to end. They look at the objective and they don't put any constraints on how they get to the objective. The sanctions, export controls, a lack of internet. If North Korea has proved anything, it's that there's no constraint that they aren't able to bypass. We can manufacture a few consequences, but they just keep getting better, more access.

And they're no longer just reading the system from the outside.

“In some cases, they're helping build it from the inside.”

We've got several North Koreans working at crypto start-ups. It's clearly a priority. And again and again, cryptos were the lines blur fastest between the IT workers who get hired and the hacking teams that come in just behind them. And as crypto goes mainstream and moves deeper into the financial system, North Korea won't be chasing it.

They'll already be there waiting inside. You're kind of nailing it right now and this is really my biggest fear. Because it's not that they're hacking crypto exchanges. Really, they were there from the beginning. They're not hacking these things as much as they've developed these web three protocols.

Whenever you and I first found out with Bitcoin was, I mean, I'd like to think that we were pretty cutting edge on some of this stuff.

But even when you and I first found out what it was, they had already absolutely masterclassed. They had already handled it begin with. When you see these guys inside these forums, they're not asking questions like, "Hey, what is Ethereum? What's this product?" They're asking very in-depth detailed questions. They already know exactly what they're looking for and they've been a part of that development cycle all the way from the beginning.

And I think this really plays into who they are as a whole because when you think of emerging technologies,

“when you think of everything new coming out, criminals, and that's what North Korea is.”

It's a criminal nationwide syndicate.

They will always latch on to these things before anyone else will.

They're early adopters, but they're also patient craftsmen. They spend years mastering whatever gives them an edge. And the next generation of tools is already falling into reach. AI systems that find vulnerabilities and personate people scale fraud and exploit human mistakes without fatigue. The people who study North Korea for a living have no doubt they'll master those tools too.

And turn them back on us either from the outside or through the access their IT workers have already gained.

“And that's why they worry less about the attacks we've already seen and more about the ones”

we're only beginning to imagine. The thing with North Korea is every time we see them, they're doing something new and something different. And quite frankly, something kind of wild. And when we see those types of attacks, we might not initially know for sure yet it's North Korea.

But our gut instinct always, when we see that kind of thing is,

this is a weird nation in state of tap, who would do this? Oh, probably it's North Korea. So North Korea is a wild card. Anything could happen with North Korea. That's a wrap on to catch a thief.

[music] Follow to catch a thief to make sure you don't miss the next episode. And if you like what you hear, re-in-review the show. To catch a thief is co-produced by mean, a cool proleroth, and rubric in partnership with pod people. With special thanks to Julia Lee.