North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application

A North Korean IT worker infiltrated a U.S. healthcare provider’s network by posing as a legitimate remote IT professional during the hiring process, a scheme that Trellix researchers recently uncovered and described as part of a malware-less intrusion trend. According to Trellix, their investigation shows a fake applicant advancing through the recruitment workflow, with OSINT work by analyst @SttyK revealing roughly 1,400 email addresses tied to North Korean operatives seeking Western employment during mid-2025.

The healthcare provider’s Talent Acquisition team invited a candidate named “Kyle Lankford” to complete a coding assessment for a Principal Software Engineer role, with the invitation sent on 10 July 2025, the assessment completed on 16 July 2025, and a follow-up on 4 August 2025. The analysis noted that the interaction appeared routine, with legitimate URLs and DMARC headers, and no malicious payload or phishing URL was present.

The piece highlights mitigations such as combining high‑fidelity threat intelligence with active hunting and OSINT feeds to block such hires and detect anomalies before they become insider threats.