LinkedIn Crypto Job Seekers Could be Members of North Korean Cybercriminals

• North Korean threat actors continue posing as recruiters and job seekers on LinkedIn
• This activity intends to target crypto and IT firms and gain access to their infrastructure
• Recently found profiles claim to be from Morocco, Argentina, and Nigeria, among others 

North Korean threat actors are targeting researchers for unearthing their scams. This time, it is the DPRK against cybersecurity researchers regularly posting updates about their fraudulent profiles on LinkedIn.

Cybersecurity Analyst Dominic Alvieri shared several fraudulent LinkedIn accounts created with a focus on recruiters from the cryptocurrency and IT industry.  

The profiles were complete with hundreds of followers, connections, profile pictures, professional details, and open-to-work status. They used distinct list locations from Nigeria to Argentina, boosting credibility among visitors.  

The profiles were crafted to attract recruiters looking for full-stack engineers, blockchain developers, IT project managers, and the like, so they gain access to similar infrastructure upon selection.

In April, Alvrieri shared screenshots of a North Korean recruiter profile on LinkedIn posing to be from Colombia, whose name was Juan Diego Suarez, and had 62 connections. Juan posed as a ‘Human Resources Recruiter at Blocknovas.’

Although Blocknovas was seized by the FBI in a joint effort against North Korean cyber actors for deceiving with fake job postings and distributing malware, new profiles still surface on LinkedIn.

The FBI released guidance detailing how the DPRK targets the crypto industry. These account holders often urge moving the communication away to another platform, so other account details get exposed. 

They offer investment from prominent companies and promote the use of non-standard software for video conferencing.

As if this were not enough, threat actors targeted the LinkedIn account of Alvieri.  Alvieri wrote that his account was hacked while his access had been temporarily restricted all week.