North Korean IT Workers in Western Firms Now Demanding Ransom for Stolen Data
In addition to stealing intellectual property, North Korean IT workers who pose as foreign employees and work for Western corporations are also demanding ransoms to keep their stolen material secret, adding a new dimension to their financially driven attacks.
Secureworks Counter Threat Unit (CTU) revealed in a research released this week that in certain cases, fraudulent personnel demanded ransom payments from their former employers after getting insider access—a practice not seen in previous scams. In one instance, a contractor began working in mid-2024 and almost immediately began exfiltrating proprietary data.
The cybersecurity organization noted that Nickel Tapestry, also known as Famous Chollima and UNC5267, is a threat group it tracks, and this action is comparable to them rea...