July 25, 2024 KnowBe4, a US-based security vendor, unknowingly hired a North Korean hacker who attempted to introduce malware into the company’s network. CEO Stu Sjouwerman revealed that the hacker, who used a stolen US identity and an AI-enhanced photo, was detected before causing significant damage. Despite passing video interviews and background checks, the hacker’s suspicious activities were flagged by KnowBe4’s Security Operations Center (SOC) when the provided workstation began loading malware upon receipt.

The investigation found that the hacker manipulated session history files and attempted to execute unauthorized software using a Raspberry Pi. SOC’s prompt action, including containing the device, prevented further damage. KnowBe4’s SOC team and external cybersecurity experts like Mandiant, along with the FBI, are involved in the ongoing investigation, which has confirmed the individual’s North Korean origin.

The incident highlights the sophisticated tactics employed by cybercriminals and nation-state actors to infiltrate secure organizations. KnowBe4 has emphasized the importance of stringent security measures and vigilant hiring practices to mitigate such risks. Sjouwerman noted that the employee was isolated from production systems, limiting potential impact, and reiterated the need for robust security protocols to counter advanced threats.