DTEX Systems reposted this
KnowBe4 hired a software engineer. As soon as they received their laptop the SOC light up like a christmas tree because of the malware it was loading up. Working with Mandian and the FBI, it turned out it was a fake IT worker from N. Korea. Everyone needs to stay vigilant out there. https://lnkd.in/eW975nJu
Jason Brown
1mo
I wonder if a background check was performed in this case?
Rory Duncan
1mo
What the????
Max Solonski
1mo
While not uncommon, this particular story does not appear realistic. A state actor gaining access this way would not immedaitely reveal themself, especially to garden variety EDR tools. Nor they would use a raspberry pi to install malware. I suspect this story gained a few vibrant colors over time.
Shubham K.
1mo
KnowBe4 reached out to me long time ago to buy their useless phishing software which Microsoft has prebuilt in its M365 E5 license. I got some really p(fishy) vibes from the company and felt like a side hustle to get rich quick. With hiring North Korean hackers for their phishing software seems like a trend this company is going to go with. Sad
Syed Hussaini
1mo
Not even close to real. Threat actors, no matter how inexperienced, will never use a Raspberry Pi to "install" software, let alone connect it, on day one. And install "malware", like really? No recon nothing?
Akeem Williams
1mo
And I can’t even get an interview 🥲
Mark Underwood
1mo
This one close to home. Like Crowdstrike, “it’s just software.” And all that entails. If true (considering the eye rolling in the comments here) and not saying it was an issue with KnowBe4, but the bar for a job description is pretty low. A generic alphabet soup of acronyms and product names in a job description is well suited to AI-assisted attacks. I could see this happening with an SMB or a small contracted task or volunteer work in GitHub.
Jace T.
1mo
> Security awareness company? > Hires North Korean IT worker?? While I have nothing ill to say on KnowBe4, I also know that there are countless identity validation solutions that would have, offered an edge pre-hire at validating this person's identity and history and preventing the malicious hire. We even utilize a system of the sort to protect customer accounts and device control. I think this is...an odd event for a security company sure but I think it's an indicator that as an industry we need to look deeper at the, HR and onboarding process, and both find and seize opportunity to bolster identity validation steps. I think out of any industry, security vendors "and friends" get a free pass to have absolutely overkill, validation and protection measures - and we should use that privilege to the maximum possible before allowing strangers into our castle.
Executive Advisor | CISO | Board Member/Director | Global Cybersecurity | Risk Management | Executive Management | Business Continuity & Resilience | Regulatory & Compliance | Manufacturing, FinServ & Retail
1mo😬