Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label identity. Show all posts
IT Security
Cyber Security Department of Justice fake remote tech jobs identity Identity Theft IT Industry IT Security

US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies

 

The U.S. Department of Justice has announced coordinated enforcement actions targeting a North Korean operation that allegedly used stolen identities and fraudulent remote employment to generate money for the regime. The investigation has resulted in charges against 14 individuals, two arrests and the seizure of approximately 187 computer devices. Authorities also searched more than 40 suspected laptop farms across Texas. 

The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes. 

In a case announced by the U.S. Attorney’s Office for the Northern District of Ohio, American nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under a four-count indictment involving wire fraud, money laundering and identity theft. The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang and others, while two additional defendants remain unidentified under seal. 

According to prosecutors, the alleged scheme operated from 2019 until approximately July 2025. North Korean workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear to be Americans applying for jobs from within the United States. U.S.-based facilitators allegedly received company-issued laptops at their homes, configured the devices, installed remote-access software and helped transfer earnings to accounts controlled by North Korea. The affected employers operated in sectors including healthcare, communications, cybersecurity support, retail and manufacturing. 

The companies were located across Ohio, 16 other states and the District of Columbia. Separately, the FBI carried out Operation Lonestar Roundup between September 21 and September 25, searching more than 40 residences in Texas suspected of hosting laptop farms. Investigators seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to facilitate fraudulent employment and revenue generation. 

Cybersecurity company CrowdStrike has identified the network of North Korean workers and their helpers as “Famous Chollima.” Investigators also identified fraudulent email accounts allegedly linked to the activity. The FBI has urged employers to add these addresses to their screening indicators and published a new public service announcement outlining detection and prevention measures. 

Authorities warned that the schemes are evolving. North Korean workers are reportedly recruiting more American facilitators to evade improved corporate screening, assigning them additional responsibilities and, in some cases, subcontracting entire jobs to foreign nationals. The latest actions form part of the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which targets illicit revenue operations and the people supporting them inside the United States. 

Previous enforcement actions were announced in June and November 2025 and April and May 2026. Officials have repeatedly warned that these workers can also use their access to steal sensitive company information or carry out data extortion. A 2022 advisory from U.S. agencies stated that individual North Korean IT workers could earn as much as $300,000 annually, contributing to hundreds of millions of dollars in collective yearly revenue. 

The State Department has offered rewards of up to $5 million for information supporting efforts to disrupt North Korea’s illicit financial activities. The Justice Department stressed that the allegations in the court documents have not been proven. All defendants are presumed innocent unless found guilty in court.
Read more »
Tech
Banks Cyber Security Data Data Leak digital scam identity Scam Tech

High Court Squashes Ban for Sim-Swap Fraud, Says Zero Customer Liability


In an important ruling amid surging digital financial fraud attacks, the Bombay HC sided with the customer protection norms. It directed Bank of Baroda to return Rs. 1.24 crore to the victim private firm that lost money in a SIM-swap case. The court stressed that if a consumer reports fraud promptly in time, “zero liability” is ruled, and the bank must reimburse the losses.                 

Private company reported the incident immediately

The order was given by a division bench of the HC, which included Justices Manjusha Deshpande and Bharati Dangre, when private company PNP Polytex (based in Mumbai) submitted a petition. Polytex alleged that Rs.1.24 crore had been stolen from its bank accounts illegally and without knowledge. 

About court proceedings

As per the submissions to the court, the firm informed the bank soon after finding malicious transactions and asked the accounts to be frozen. The bank could only save Rs. 47.8 lakh, the remaining money was already stolen by the hackers. After this, the firm moved to HC for help.

Later, enquiry revealed that the scam was done using a SIM-swap tactic, where hackers get control of the target’s registered contact number. This lets the hackers intercept OTPs and do banking transactions without the account owner's consent and knowledge. The high court found that the scam was done by third-parties, and showed no evidence of negligence on consumer’s end.

What is RBI’s zero liability rule?

During the proceedings, the court referred to the July 6, 2017 statement given by the RBI, which laid down the customer protection guidelines in incidents of illegal electronic banking transactions. According to the circular, the consumers are entitled to zero liability if they report fraud transactions within 72 hours (three days).

In the judgement, the high court stressed that if a customer informs the bank about a scam or fraud, it is the duty of the bank to return the disputed amount back to the victim’s account. The court also said that the burden of proving customer negligence is on the bank too.  

The court rejected the bank's defenses that it had followed the due process and security measures, and the bench  labelled the argument as a “lame excuse,” saying that such mechanisms become powerless when a SIM card is hacked. The court also attributed another ruling in an incident where HDFC bank was held liable under similar situations. 

Bank will return stolen amount with interest

After revising the previously frozen funds, the High Court ordered the bank to return the remaining sum plus 6% interest within eight weeks. 

Read more »
Orchid security
Audit Cyber Security IAM identity Online Authentication Orchid security

Orchid Security Launches Tool to Monitor Identity Behavior Across Business Applications

 



Modern organizations rely on a wide range of software systems to run daily operations. While identity and access management tools were originally designed to control users and directory services, much of today’s identity activity no longer sits inside those centralized platforms. Access decisions increasingly happen inside application code, application programming interfaces, service accounts, and custom login mechanisms. In many environments, credentials are stored within applications, permissions are enforced locally, and usage patterns evolve without formal review.

As a result, substantial portions of identity activity operate beyond the visibility of traditional identity, privileged access, and governance tools. This creates a persistent blind spot for security teams. The unseen portion of identity behavior represents risk that cannot be directly monitored or governed using configuration-based controls alone.

Conventional identity programs depend on predefined policies and system settings. These approaches work for centrally managed user accounts, but they do not adequately address custom-built software, legacy authentication processes, embedded secrets, non-human identities such as service accounts, or access routes that bypass identity providers. When these conditions exist, teams are often forced to reconstruct how access occurred after an incident or during an audit. This reactive process is labor-intensive and does not scale in complex enterprise environments.

Orchid Security positions its platform as a way to close this visibility gap through continuous identity observability across applications. The platform follows a four-part operational model designed to align with how security teams work in practice.

First, the platform identifies applications and examines how identity is implemented within them. Lightweight inspection techniques review authentication methods, authorization logic, and credential usage across both managed and unmanaged systems. This produces an inventory of applications, identity types, access flows, and embedded credentials, establishing a baseline of how identity functions in the environment.

Second, observed identity activity is evaluated in context. By linking identities, applications, and access paths, the platform highlights risks such as shared or hardcoded secrets, unused service accounts, privileged access that exists outside centralized controls, and differences between intended access design and real usage. This assessment is grounded in what is actually happening, not in what policies assume should happen.

Third, the platform supports remediation by integrating with existing identity and security processes. Teams can rank risks by potential impact, assign ownership to the appropriate control teams, and monitor progress as issues are addressed. The goal is coordination across current controls rather than replacement.

Finally, because discovery and analysis operate continuously, evidence for governance and compliance is available at all times. Current application inventories, records of identity usage, and documentation of control gaps and corrective actions are maintained on an ongoing basis. This shifts audits from periodic, manual exercises to a continuous readiness model.

As identity increasingly moves into application layers, sustained visibility into how access actually functions becomes essential for reducing unmanaged exposure, improving audit preparedness, and enabling decisions based on verified operational data rather than assumptions.

Read more »
Security
AI Banking Biometrics Cyber Crime Fintech Fraud identity Payments Scams Security

Account Takeover Fraud Surges as Cybercriminals Outpace Traditional Bank Defenses

 

As financial institutions bolster their fraud prevention systems, scammers are shifting tactics—favoring account takeover (ATO) fraud over traditional scams. Instead of manipulating victims into making transactions themselves, fraudsters are bypassing them entirely, taking control of their digital identities and draining funds directly.

Account takeover fraud involves unauthorized access to an individual's account to conduct fraudulent transactions. This form of cybercrime has seen a sharp uptick in recent years as attackers use increasingly advanced techniques—such as phishing, credential stuffing, and malware—to compromise online banking platforms. Conventional fraud detection tools, which rely on static behavior analysis, often fall short as bad actors now mimic legitimate user actions with alarming accuracy.

According to NICE Actimize's 2025 Fraud Insights U.S. Retail Payments report, the share of account takeover incidents has increased in terms of the total value of fraud attempts between 2023 and 2024. Nevertheless, scams continue to dominate, making up 57% of all attempted fraud transactions.

Global financial institutions witnessed a significant spike in ATO-related incidents in 2024. Veriff's Identity Fraud Report recorded a 13% year-over-year rise in ATO fraud. FinCEN data further supports this trend, revealing that U.S. banks submitted more than 178,000 suspicious activity reports tied to ATO—a 36% increase from the previous year. AARP and Javelin Strategy & Research estimated that ATO fraud was responsible for $15.6 billion in losses in 2024.

Experts emphasize the need to embrace AI-powered behavioral biometrics, which offer real-time identity verification by continuously assessing how users interact with their devices. This shift from single-point login checks to ongoing authentication enables better threat detection while enhancing user experience. These systems adapt to variables such as device type, location, and time of access, supporting the NIST-recommended zero trust framework.

"The most sophisticated measurement approaches now employ AI analytics to establish dynamic baselines for these metrics, enabling continuous ROI assessment as both threats and solutions evolve over time," said Jeremy London, director of engineering for AI and threat analytics at Keeper Security.

Emerging Fraud Patterns
The growth of ATO fraud is part of a larger evolution in cybercrime tactics. Cross-border payments are increasingly targeted. Although international wire transfers declined by 6% in 2024, the dollar value of fraud attempts surged by 40%. Fraudsters are now focusing on high-value, low-volume transactions.

One particularly vulnerable stage is payee onboarding. Research shows that 67% of fraud incidents were linked to just 7% of transactions—those made to newly added payees. This finding suggests that cybercriminals are exploiting the early stages of payment relationships as a critical vulnerability.

Looking ahead, integrating multi-modal behavioral signals with AI-trained models to detect sophisticated threats will be key. This hybrid approach is vital for identifying both human-driven and synthetic fraud attempts in real-time.
Read more »
Verification
AI Cyber Fraud Cybersecurity Deepfake Fraud identity Recruitment Resume Verification

Fake Candidates, Real Threat: Deepfake Job Applicants Are the New Cybersecurity Challenge

 

When voice authentication firm Pindrop Security advertised an opening for a senior engineering role, one resume caught their attention. The candidate, a Russian developer named Ivan, appeared to be a perfect fit on paper. But during the video interview, something felt off—his facial expressions didn’t quite match his speech. It turned out Ivan wasn’t who he claimed to be.

According to Vijay Balasubramaniyan, CEO and co-founder of Pindrop, Ivan was a fraudster using deepfake software and other generative AI tools in an attempt to secure a job through deception.

“Gen AI has blurred the line between what it is to be human and what it means to be machine,” Balasubramaniyan said. “What we’re seeing is that individuals are using these fake identities and fake faces and fake voices to secure employment, even sometimes going so far as doing a face swap with another individual who shows up for the job.”

While businesses have always had to protect themselves against hackers targeting vulnerabilities, a new kind of threat has emerged: job applicants powered by AI who fake their identities to gain employment. From forged resumes and AI-generated IDs to scripted interview responses, these candidates are part of a fast-growing trend that cybersecurity experts warn is here to stay.

In fact, a Gartner report predicts that by 2028, 1 in 4 job seekers globally will be using some form of AI-generated deception.

The implications for employers are serious. Fraudulent hires can introduce malware, exfiltrate confidential data, or simply draw salaries under false pretenses.

A Growing Cybercrime Strategy

This problem is especially acute in cybersecurity and crypto startups, where remote hiring makes it easier for scammers to operate undetected. Ben Sesser, CEO of BrightHire, noted a massive uptick in these incidents over the past year.

“Humans are generally the weak link in cybersecurity, and the hiring process is an inherently human process with a lot of hand-offs and a lot of different people involved,” Sesser said. “It’s become a weak point that folks are trying to expose.”

This isn’t a problem confined to startups. Earlier this year, the U.S. Department of Justice disclosed that over 300 American companies had unknowingly hired IT workers tied to North Korea. The impersonators used stolen identities, operated via remote networks, and allegedly funneled salaries back to fund the country’s weapons program.

Criminal Networks & AI-Enhanced Resumes

Lili Infante, founder and CEO of Florida-based CAT Labs, says her firm regularly receives applications from suspected North Korean agents.

“Every time we list a job posting, we get 100 North Korean spies applying to it,” Infante said. “When you look at their resumes, they look amazing; they use all the keywords for what we’re looking for.”

To filter out such applicants, CAT Labs relies on ID verification companies like iDenfy, Jumio, and Socure, which specialize in detecting deepfakes and verifying authenticity.

The issue has expanded far beyond North Korea. Experts like Roger Grimes, a longtime computer security consultant, report similar patterns with fake candidates originating from Russia, China, Malaysia, and South Korea.

Ironically, some of these impersonators end up excelling in their roles.

“Sometimes they’ll do the role poorly, and then sometimes they perform it so well that I’ve actually had a few people tell me they were sorry they had to let them go,” Grimes said.

Even KnowBe4, the cybersecurity firm Grimes works with, accidentally hired a deepfake engineer from North Korea who used AI to modify a stock photo and passed through multiple background checks. The deception was uncovered only after suspicious network activity was flagged.

What Lies Ahead

Despite a few high-profile incidents, most hiring teams still aren’t fully aware of the risks posed by deepfake job applicants.

“They’re responsible for talent strategy and other important things, but being on the front lines of security has historically not been one of them,” said BrightHire’s Sesser. “Folks think they’re not experiencing it, but I think it’s probably more likely that they’re just not realizing that it’s going on.”

As deepfake tools become increasingly realistic, experts believe the problem will grow harder to detect. Fortunately, companies like Pindrop are already developing video authentication systems to fight back. It was one such system that ultimately exposed “Ivan X.”

Although Ivan claimed to be in western Ukraine, his IP address revealed he was operating from a Russian military base near North Korea, according to the company.

Pindrop, backed by Andreessen Horowitz and Citi Ventures, originally focused on detecting voice-based fraud. Today, it may be pivoting toward defending video and digital hiring interactions.

“We are no longer able to trust our eyes and ears,” Balasubramaniyan said. “Without technology, you’re worse off than a monkey with a random coin toss.”
Read more »
Sensitive data
cyber attack identity Microsoft Security Sensitive data

Microsoft Tightens Cloud Security After Major Breaches

 



In its efforts to better its cloud security, Microsoft has done much to remove any potential vulnerabilities and tightened the process of authenticating individuals. This comes after the tech giant saw several security breaches within the past year. Under the Secure Future Initiative launched in November 2023, Microsoft has so far purged 730,000 unused applications and deactivated 5.75 million inactive tenants in its cloud system. The initiative has been a direct response to cyber intrusions that had resulted in the revelation of sensitive data.

Reducing the Cyber Attack Surface

The firm has sought to minimise its attack surface by identifying dead or idle areas of its cloud infrastructure and is working to eliminate them. Removing hundreds of thousands of applications and millions of unused tenants works at making Microsoft shrink down the possible avenues the hackers may employ to penetrate it. Furthermore, Microsoft has sought to make the software production environment more secure by equipping the software teams with 15,000 locked-down devices. In its other security measure, the company conducted video-based identity verification for 95 percent of its production staff for further security in the identity authentication process. 

Better Identity and Authentication Security

Cybersecurity is one aspect where Microsoft has improved much. For instance, the identity management systems for its Entra ID and Microsoft Account (MSA) platforms have been remarkably enhanced.

These updates target better generation, storage, and rotation of access token signing keys as means to advance the protection of the public and government cloud environments. This is partly because of an incident in 2023, when hacking group Storm-0558 from China successfully accessed Exchange Online systems and penetrated the private email accounts of dozens of state officials. 

Secure Future Initiative Focus Areas

The SFI project is the most ambitious cybersecurity effort Microsoft has undertaken to date, providing 34,000 engineers dedicated to bulking up the company's defences. It focuses mainly on six critical areas: identity and access control, securing cloud tenants and production systems, strengthening engineering systems, improving network security, enhancing threat detection, and perfecting incident response. By doing all of these broad strokes, the likelihood of any future breach of this scale is reduced.

Mitigating Past Security Mistakes

Analysis by the US Department of Homeland Security's Cyber Safety Review Board had shown that a succession of security lapses at the company allowed these breaches. The inquiry, focused on the Storm-0558 intrusion, had asserted that it was time for Microsoft to strengthen its security posture, which primarily revolved around identity and authentication processes. Based on this, the company has moved very quickly to shore up weaknesses and prevent something similar from happening in the future.

Progress in Key Security Areas

Microsoft says it made strides in several areas in the latest report on SFI.

Unused applications and tenants removed reduce cloud attack surface. In network security, the firm now maintains a central inventory for more than 99% of physical assets, providing greater oversight.

Virtual networks with back-end connectivity are isolated from the corporate networks, which in turn is subjected to even more rigorous security audits. Centralised pipeline templates accounting for 85% of the production builds have been so far a part of the security. Personal access tokens now also have a much shorter life. Proof-of-presence checks are also instituted at the most sensitive points of the software development pipeline. 

Organisational Changes for Better Security

Beyond the technical, there have been organisations which are aimed at ensuring the executives are held responsible for security outcomes. There have been those who tied senior leadership compensation to specific security goals and that the company's threat intelligence team reports directly to the Chief Information Security Officer. This is in the way that it gives the assurance that security is top of the agenda across the organisation.

The Microsoft Secure Future Initiative is a reflection of its attempt to learn from previous failures in the area of security and succeed further in the cloud environment. The company intends to secure itself and, by extension, its customers from future cyber-attacks by enforcing identity verification, reducing attack surfaces, and having a strong network as well as engineering security. Hence, through continuous actions, Microsoft aims to ensure that such instances-where confidential and sensitive data are leaked-would not recur in the future.





Read more »
syndicates
criminals criminals' methods Cyber Crime fake license fake plates Hijacking identity identity concealment insight investigator Mercedes-Benz police force stolen syndicates

Recovered Stolen Mercedes Offers Glimpse into Hijackers' Tactics

 

A recently recovered Mercedes-Benz, which had been stolen and then found equipped with counterfeit license plates and a forged license disc, has shed light on the operational tactics of hijacking syndicates and their ability to exploit technological advancements to evade capture.

Specialist investigator Mike Bolhuis, drawing on his extensive experience in investigating serious, violent, and cyber crimes, shared insights regarding the strategies employed by hijackers to conceal their identities and mask stolen vehicles.

Marshall Security, on Tuesday, announced the retrieval of a stolen Mercedes-Benz C200 along Sinembe Crescent near uMhlanga Rocks Drive, situated in the Somerset Park region. This vehicle was reportedly taken from Reservoir Hills the previous week.

Following the recovery, Marshall Security disclosed that the abandoned vehicle was equipped with fraudulent plates and a counterfeit license disc. The South African Police Service (SAPS) had been actively searching for the vehicle.

However, as Bolhuis emphasizes, false license discs and plates merely scratch the surface of the broader issue associated with hijacking. Criminals exploit technological advancements, while law enforcement faces challenges in combating these crimes.

Bolhuis characterizes the methods employed by criminals to mask their identities and switch between aliases as a form of cybercrime. He explains that criminals employ fabricated identities and counterfeit information for vehicles, often with assistance from corrupt individuals within various sectors.

These criminal activities are grounded in cybercrime, a global concern. Criminals exploit this digital realm to fabricate false documents routinely, rendering their capture challenging. Bolhuis asserts that law enforcement's struggle against digital crimes is compounded by their limited capacity, enabling criminals to exploit this weakness.

He asserts that the primary means of apprehending these criminals involves witnesses, forensic information, or digital tracking. Bolhuis highlights the necessity of gathering forensic evidence, citing the potential of trace elements such as saliva or hair follicles, as well as using indicators like dirt on wheels to deduce the stolen vehicle's movements.

Upon stealing a vehicle, criminals adapt their approach based on their objectives. They may fulfill orders for high-end vehicles or employ the stolen cars in the commission of other crimes. Vehicles are sometimes used to ram cash-transit vehicles or for ATM bombings before being left at the scene. Bolhuis particularly underscores the importance of forensic data in narrowing down suspects.

The latest statistics from the South African Police Service (SAPS) reveal that between April and June 2023, 9,081 motor vehicles and motorcycles were reported as stolen. Carjackings accounted for a significant portion, with 2,591 sedans, coupes, and hatchbacks stolen, along with 1,582 bakkies.

The Western Cape and Gauteng regions of South Africa experienced the highest incidence of carjackings, reflecting the pervasive nature of this criminal phenomenon.
Read more »
Subscribe to: Posts (Atom)