North Korean Hackers Leverage AI in Sophisticated Scam Targeting Industries In a rare firsthand account, Ryan LaSalle, CEO of human risk management firm Nisos, revealed details of an AI-driven cyberattack orchestrated by North Korean threat actors. The incident underscores the growing sophistication of state-backed hackers leveraging artificial intelligence to breach critical systems, particularly in the manufacturing sector. LaSalle’s team uncovered the scam, which exploited AI tools to enhance social engineering tactics, financial fraud, and intellectual property theft. The attack highlights the escalating risks posed by foreign adversaries using advanced technologies to infiltrate high-value industries, with potential consequences ranging from financial losses to compromised proprietary data. The disruption of this operation by Nisos provides a case study in how AI-powered threats are evolving and why organizations must treat such intelligence with heightened urgency. The full investigation report offers deeper insights into the methods and impact of these emerging cyber risks.

North Korean Operative Attempts AI-Assisted Fraud to Infiltrate U.S. Cybersecurity Firm A suspected North Korean IT worker attempted to secure a senior remote role at U.S.-based threat intelligence firm Nisos in June 2025, using a stolen identity, AI-generated materials, and sophisticated remote access tools. The incident underscores the evolving tactics of DPRK-linked employment fraud, blending traditional identity theft with AI and VPN-based anonymization. The operative applied for a Lead AI Architect position under the guise of a Florida-based full stack developer and AI specialist, using stolen personally identifiable information (PII), a fabricated email, and a VoIP phone number. Network analysis tied the applicant to Astrill VPN, a service previously linked to North Korean remote IT worker activity. The AI-generated resume closely mirrored Nisos’ job description, listing skills and technologies verbatim from the posting including programming languages, cloud platforms, and OSINT tools while the summary section reused phrasing about "researching emerging agentic AI technologies." During a virtual interview, the candidate exhibited telltale signs of AI assistance, frequently looking away from the camera, pausing with the phrase "How can I say?", and failing to recognize a fake "Hurricane George" question designed to test authenticity. Pre-employment OSINT revealed three inconsistent resume profiles under the same name, all referencing the real address of a Florida resident confirming identity theft. When Nisos shipped a corporate laptop to the provided address (different from the resume’s), tracking revealed a "laptop farm" inside a closet, containing ~20 devices managed via Raspberry Pi-based PiKVM hardware. This setup allowed remote operators to control multiple machines undetected, using Tailscale’s mesh VPN for encrypted command execution and data exfiltration. The investigation identified ~40 devices on the network, with many tied to different employee identities across multiple companies. Security researchers warn this model enables DPRK operatives to earn foreign currency and access sensitive corporate data while evading detection. The case highlights the need for enhanced remote hiring controls, including deeper identity verification and technical interviews to expose AI-assisted deception.