DPRK IT Worker Fraud Expands Into Healthcare and Sales Roles

Mon, 31 Aug 2026 18:00:29 +0000

Engineer — Skip
SOC/IR — Learn: Expands the known DPRK IT-worker insider-threat profile into healthcare and sales; no IOCs or ATT&CK-mapped TTPs are provided, so there is no detection work to action today, but analysts should update their mental model of which hiring pipelines are targeted.
Leader — Plan: The scheme now threatens non-IT hiring pipelines, including healthcare where regulatory exposure is high; review remote-hire verification procedures and brief HR leadership on enhanced identity-vetting requirements for fully-remote roles across all business units.

Dprk on CuraSec