Behind the Screen: Unmasking North Korean IT Workers' Operations and Infrastructure

No ratings

Presented at Black Hat USA 2025 by

SttyK SttyK

North Korea deploys sophisticated cyber operations to generate foreign currency through cryptocurrency theft and covert IT worker placements. These funds directly support the Kim regime's power consolidation and nuclear weapons development.Our investigation provides unprecedented visibility into these operations' human elements and organizational structures. Unlike previous research that focused on technical indicators or theoretical attribution, we reveal the operational workflow through advanced OSINT techniques—from sophisticated identity forgery and cover story development to command hierarchies and field operations.We present actionable intelligence, including social engineering patterns, fake ID creation methods, and detailed playbooks for cultivating cover accounts. This intelligence equips security professionals with practical countermeasures against these sophisticated threat actors and offers rare insights into the actual mechanics of North Korean cyber operations.Note: This session will be delivered as a live experience only and will not be recorded or available for on-demand viewing after the event.