Mandiant / Google Cloud Threat Intelligence blog
DPRK IT workers (UNC5267) obtaining remote employment; facilitator case · 2024-09-23 (datePublished)
Mandiant tracks IT worker operations we have identified in various environments as UNC5267. ... Their mission is to secure lucrative jobs within Western companies, especially those in the U.S. tech sector. ... One American facilitator working with the IT workers compromised more than 60 identities of U.S. persons, impacted more than 300 U.S. companies, and resulted in at least $6.8 million of revenue to be generated for the overseas IT workers from in or around October 2020 until October 2023.