BLOG

The OpenSourceMalware Show #25

GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms

By cb482791-4ef1-4762-96ad-b0ca4bdd538e · 2026-10-15T18:00:00.000Z

The OpenSourceMalware Show is available on YouTube, LinkedIn, and as a podcast.

This week we talked about:

GitHub push attribution: GitHub now shows when the account that pushed a commit is different from the one listed as the committer, which makes faked Git history easier to spot. That could help flag PolinRider-style changes and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open source maintainers who are targeted most.
GitHub Actions workflow lockfiles: Workflow lockfiles keep a GitHub Actions workflow pointed at the version you chose, even if an attacker moves the tag. That should help against attacks like tj-actions and Trivy, though it wouldn’t stop GhostAction, and setup requires installing a GitHub CLI extension.
GhostAction expands to phishing: GitGuardian first discovered GhostAction in 2025. It’s a malicious GitHub Actions workflow that sweeps a repo’s full Git history for credentials. The operators have now registered a GitHub lookalike domain and are phishing open source maintainers with fake sign-in alerts. Their kit proxies the real GitHub login and got past the MFA methods it was tested against. The same IP has also been mass scanning the internet for about a year.
North Korean IT worker laptop farms: The US Department of Justice announced Operation Lonestar Roundup, with law enforcement actions in Ohio and Texas and approximately 187 computers seized. We explain how the IT worker scheme works and why operatives need US-based laptop farms to hide where they are. We also cover how they find people to host the laptops.

Resources

[00:00:00] Jenn Gile: Okay. Hello. It is Thursday, October 15th. I gotta do something a little different with the intro today. I was listening to another podcast and I was like, “Wow, we really do cold open this thing.” Like, we don’t introduce ourselves. We don’t say what we’re gonna talk about. So, let’s go crazy here. I’m Jenn Gile.

[00:00:18] Jenn Gile: Uh, I have Paul McCarty with me. We’re the co-founders of OpenSourceMalware. This is episode 25 of the OpenSourceMalware Show, where we take apart the week’s malware news, specific usually to software supply chain malware. And we have a really, um, great diverse range of things to talk about today. So just to kinda summarize, GitHub has made several announcements that’s we’re gonna go over.

[00:00:47] Jenn Gile: There’s been a lot of action with the GhostAction campaign, and we’re gonna, uh, touch briefly on some things going on with, um, the North Korean IT worker scam. But before we get into that, I am in lovely Washington, D.C. this week for the SANS DFIR, uh, Summit. Really enjoying that so far. I’m gonna be speaking tomorrow.

[00:01:11] Jenn Gile: Paul, how’s your week shaping up?

[00:01:14] Paul McCarty: Yeah, it’s, um, it, it’s shaping up and shaking up to be, uh, to be entertaining. Um, like I said last time, I’m enjoying being here, um, and you know, just kind of chilling. W- you and I have both been traveling a lot this year, so I’m really looking forward to RooCon in November.

[00:01:32] Paul McCarty: I’m super excited. I just saw the agenda yesterday. Oh my God, it’s sick. This is like a TLP Red, um, conference that Google puts on down in Sydney, and I, um, they picked up one of my talks this year. Um, so these are gonna be tight talks. 25 minutes. Oh my gosh, I hate doing 25-minute talks.

[00:01:51] Jenn Gile: I know. I- That’s what I’m doing at SANS tomorrow, and it’s like, oof, it’s g- drink some coffee and let her rip.

[00:01:57] Paul McCarty: Right? Exactly, no intro, just it’s like re- we are, our intro for this.

[00:02:03] Jenn Gile: Exactly. Just

[00:02:03] Paul McCarty: right into it, baby.

GitHub push attribution exposes forged commit history, but only for Enterprise

[00:02:05] Jenn Gile: All right. So, uh, lots of GitHub security-related things. Uh, the first one that I wanna talk about is they announced push attribution for commits, which if you’ve been following anything Paul and I have been talking about, uh, you might understand why this is really important.

[00:02:26] Jenn Gile: Um, it is trivial to fake Git history, um, when you’re, uh, committing to GitHub. And so, uh, what GitHub is doing, asterisk, asterisk, private prev- or public preview, you know, GitHub Enterprise only. Like, it’s not everyone who gets this right now. Um, but what they’re doing is when, uh, in the UI and I assume in the, uh, CLI as well, but I’ve only looked at it in the UI, there will be a second name if the, um, if there’s a, a disparity between who the original commit was from and, like, the account that pushed it.

[00:03:08] Jenn Gile: So I looked at a sample the other day, and basically, like, what you would see is the original commit and a date stamp, and then if who pushed it, the identity that pushed it is different, you’ll see a separate identity and date, or if it’s the same, then the identities and dates will match on both. And so this is useful in two scenarios.

[00:03:36] Jenn Gile: Definitely the PolinRider one that we’ve been talking a lot about where you find suspicious changes in your code. You can’t figure out where it comes from. You went and looked at your commits. At this point, if you had this feature turned on, you would be able to see, oh, this is weird. Even though this commit went through on this date, I’m seeing somebody push something on a subsequent date.

[00:03:57] Jenn Gile: So that would be, like, a nice red flag in the UI. The other scenario would be if, um, somebody has gotten access to your credentials and, you know, has gotten- Uh, z- I don’t know that it’s a full account takeover kind of thing, but it, if they push something, you would be able to see. And with some of the, um, permissions around this, depending on what you have in place, you can make it so that, like, emails have to match, things like that.

[00:04:27] Jenn Gile: You could set up rules. So I’ll stop there. I said a lot. Paul, you’ve had a little bit of time to think about this one. Um, like taking aside who it’s available for, which we should definitely talk about, uh, thoughts about the feature

[00:04:42] Paul McCarty: Well, I certainly support it, and I said, um, to you and to a group of my Signal chat members that, um, you know, I think it’s probably one of the best changes that GitHub has introduced.

[00:04:55] Paul McCarty: That having been said, I’m still trying to work out… I was just looking at some historical, um, TasksJacker style, um, you know, early PolinRider stuff, and it’s, uh, it’s hard for me to tell what, where the change has been made. Um, now the other thing I want to talk about is that the, this whole commit and push in GitHub, and w- we all, the whole industry kind of conflates it because, you know, the, the commits happen on the, the developer’s machine.

[00:05:25] Paul McCarty: Now, here’s the thing is that imagine a scenario where you have 10 developers that are working off of a Git directory in a local, you know, server, and they’re all checking in code. And so there’s lots of commits from me and Jenn and, you know, eight other people. One of those members then goes to push that up to GitHub, and you now have a whole bunch of commits from different people all kind of wrapped up into one push up to GitHub.

[00:05:50] Paul McCarty: You know, I’m kind of curious. I mean, and that’s by design, right? The problem, the reason, to your point earlier about how it’s materially easy to, to fake, Git wasn’t built with authentication or authorization built into it. It accepts the email address that you give it, um, and that’s how it kind of tracks the persona.

[00:06:07] Paul McCarty: And, and so I’m just kind of curious to see how… Now, admittedly, not many people use that, that style of development I just said a minute ago, but it absolutely is a legitimate way to write code. And so I’m just kind of curious how GitHub is then going to represent those commits. If Paul pushes something that has mine and 10 other people’s-

[00:06:27] Jenn Gile: Mm

[00:06:27] Paul McCarty: commits in it, how does that get represented, right?

[00:06:30] Jenn Gile: Yeah. I guess we’ll have to see some screenshots at some point from somebody who’s doing it. Um-

[00:06:37] Paul McCarty: Well, I’m gonna, I’m gonna test over the weekend.

[00:06:39] Jenn Gile: You’re gonna noodle around with it. Oh, yeah. Fun.

[00:06:41] Paul McCarty: I have to see it.

[00:06:43] Jenn Gile: Yeah. So the other side of this is who it’s accessible to.

[00:06:46] Jenn Gile: Um, it’s not a huge surprise that this is limited to GitHub Enterprise customers during a public preview. That’s their equivalent of beta. So I’m not going to assume that they’re not going to make it available to, uh, people who don’t have access to that account level, but it’s possible, and so let’s follow the trail of thought there.

[00:07:06] Jenn Gile: If they don’t make it available to free users, um, you know, a lot of open source maintainers and freelancers don’t have access to GitHub Enterprise. Um, they are the ones who tend to get targeted by a lot of these attacks. So not only are they potentially, uh, more likely to be a target, but also maybe less likely to be able to, um, have the resources to do something about it.

[00:07:34] Jenn Gile: And then, um, it’s possible that some of the rules that are, um, available with this feature may not work for public repos, um, because the rule is linked to push rule sets, which the docs say are only available for private and internal repos. So it’s kind of a like Will it work for the use cases that we’re seeing this be a big problem?

[00:08:00] Jenn Gile: W- we don’t know.

[00:08:02] Paul McCarty: Yeah, I mean, God, there’s just, like, there’s just so much. We, we could spend two episodes just talking about this feature alone, or this set of features. The n- you know, branch protections- Mm-hmm … and push protections. But you’re right. Um, push protections have been around since 2024. Um, and they, um, have always only supported internal and private repos.

[00:08:23] Paul McCarty: And I found some, um, GitHub issues where people were asking some of the, the p- uh, um, project owners at GitHub, “Wh- why does this only support, um, private repos?” And their response was, “Well, because it involves forking.” And so we then, then that means … It’s like everything in GitHub … Uh, y- so you have two things kind of going on.

[00:08:47] Paul McCarty: You have the fact that GitHub was written in a time before security. I’ve said this before, right? And it’s just kind of clunky and all these things. You know, forks is a great example of this. But also, too, let’s just be very honest. Microsoft is not doing … Y- they’re choosing to put a lot of these kind of security components in enterprise-only, um, accounts.

[00:09:05] Paul McCarty: You know, which we have one, but, like, most people don’t. Most people aren’t paying, you know, that much for, for GitHub, if anything. So you know, it doesn’t apply to a pro account. Only applies to a enterprise account. So, um, m- because forking is involved in a public, you know, you can fork somebody else’s, and if, if the originating origin repo had push protections on it, then that would then filter down into- It would

[00:09:30] Jenn Gile: inherit it.

[00:09:31] Jenn Gile: Okay.

[00:09:32] Paul McCarty: Yeah. So-

[00:09:33] Jenn Gile: Interesting …

[00:09:34] Paul McCarty: and here’s the thing is behind the scenes forking looks b- and then they will never talk about this, but forking behind the scenes in 2026 looks different than forking does, did in 2024. And so the decisions that Microsoft/GitHub made in 2024 about the kind of knock-on effects of that, that’s actually different because there are some material differences in the way forks work behind the scenes.

[00:09:56] Paul McCarty: All that having been said, um, you know, this is not gonna be a, a benefit to PolinRider, to us identifying PolinRider because, you know, the vast majority of people aren’t gonna be able to, um, use it or experience it, which is really disappointing.

GitHub Actions workflow lockfiles stop tag-swapping attacks like Trivy

[00:10:10] Jenn Gile: Yeah. My hope is that they decide to open it up to a brighter, broader audience, and I feel possibly justified in that hope because of the second feature we’re gonna talk about, which is GitHub released, uh, GitHub Actions workflow lock files.

[00:10:26] Jenn Gile: And the second I saw that I thought, “Whoa, that was fast. Like, we were just dealing with GhostAction last week. This is great.” And then I dug into it and was like, “Oh, actually it wouldn’t help with GhostAction.” Um, but it is available, it looks like, to most users, so happy to see that. So just in brief, um- This is helping with a gap that attackers have used repeatedly.

[00:10:51] Jenn Gile: Um, tj-actions is a really early example of this, where people started to realize that GitHub actions could be, uh, potentially dangerous. Trivy, um, is another good example of this. But basically, with workflows, they usually reference a tag, uh, an action by a tag. And, uh, a tag is just a label that’s pointing to a specific version of a code, and what the attackers have done with some of these attacks is they’ve just changed where it points.

[00:11:20] Jenn Gile: What the lock file does- It’s, it’s

[00:11:22] Paul McCarty: mutable

[00:11:22] Jenn Gile: Yeah, exactly. What the lock file has done is, um, regardless of how the tag might get changed, it’ll still point at the thing that you chose to point it at. So, um- Assuming people adopt them, and I think this is a really good thing to adopt, uh, it should be relatively effective for, like, the Trivy style attack.

[00:11:45] Jenn Gile: You know, if you’re using a version of Trivy that is safe, uh, they can’t force you onto another version.

[00:11:54] Paul McCarty: Yeah. I know that I don’t really have any opinions on this because I, I, um, because of what I’m about to say in a second. But before I get there, I j- I do want to say that a number of our friends, like François at Boost, like, is- is a big fan of this.

[00:12:06] Paul McCarty: And so if he feels like this is gonna be beneficial, then I, then I trust his opinion. Um, now, that having been said, it turns out you gotta do some stuff to get this to work. You actually have to install some stuff, right? So you actually have to use the GitHub CLI to install something to make this work, which I just think is the kookiest freaking thing in the world that you gotta do that.

[00:12:29] Jenn Gile: I did notice that the announcement blog for this one was what, way more detailed than we tend to see. It gave me a, like, okay, well that’s nice that it’s detailed, but this looks a little complicated.

[00:12:40] Paul McCarty: It was more than 250 characters.

[00:12:42] Jenn Gile: Yeah. Yeah. Indeed. That’s something- It was …

[00:12:46] Paul McCarty: I noticed that, too.

[00:12:47] Jenn Gile: Yeah. Uh, I…

GitHub will announce a package firewall at Universe

[00:12:48] Jenn Gile: And then there’s one more announcement that, uh, I don’t think there’s much to say at this stage- Yeah … because I would treat it as a pre-announcement. Uh, but we have seen on the GitHub Universe, uh, upcoming, uh, agenda, which I think is two weeks from now, if I’m not mistaken- It is … um, that GitHub is going to be announcing a, um, a package firewall.

[00:13:14] Jenn Gile: So that is, uh, TBD. You know, usually they stream these things. We’ll be able to watch the video after the session. We’ll see what they have to say about it. Um, I don’t think I have a lot more to say on that right now, but, uh, we should keep our eyes on it.

[00:13:31] Paul McCarty: Yeah. The devil’s in the details, right? With everything.

[00:13:33] Paul McCarty: Um, this has been a reoccurring theme. Um, I think that they’re targeting, the use case here specifically is, you know, GitHub actions. Um, and so being able to block these things via the p- uh, the firewall, which by the way, they have said is gonna be free, so that’s cool. Um, but you know, as I posted on LinkedIn, I just don’t- You know, I, I question the veracity and, you know, how effective this is gonna be.

[00:13:56] Paul McCarty: You know, I, I make fun of it all every week, but the reality is that, you know, they’re saying they’re doing NPM package scanning, and I, I’ve seen zero evidence of it except one guy talking about how it blocked something malicious in his… I personally have not seen any examples of this myself, and I’m inside the, the, the NPM malware, you know, ecosystem every day.

[00:14:16] Paul McCarty: So, uh, to be, to be

GhostAction expands from GitHub Actions workflows to phishing maintainers

[00:14:19] Jenn Gile: determined. TBD. Yeah. Okay. Our longer topic today is GhostAction. So this is a GitHub Action-related campaign, um, that our friends over at, uh, GitGuardian discovered, what, a year ago, something like that, 2025?

[00:14:36] Paul McCarty: Yeah. Yeah. An attack. Almost a year ago. Yeah, good point.

[00:14:40] Jenn Gile: Yeah. Um, so it is considered a software supply chain attack, but what it’s doing is it’s, um, it’s a malicious GitHub Actions workflow, and what it does is it sweeps a repo’s full Git history for credentials.

[00:14:55] Jenn Gile: Surprise, and of course, that’s why GitGuardian would’ve been interested in it. Uh, exfiltrates it. Um, there’s some issues around, like, things like domain blocking doesn’t work for it. It spreads in a similar way to PolinRider. So, um, once it’s in a repository, if you, uh, you know, consume that repository, you can catch it as well.

[00:15:17] Jenn Gile: Uh, so what you saw, let’s, let’s go in order here. Before we get to the second discovery that you made over the weekend, let’s talk about the first one. Um, you found it, uh, exfiltrating to a typosquatted domain, right, and some new IP addresses

[00:15:36] Paul McCarty: Yeah. The, um, the, this threat actor who, by the way, I’m very intrigued, but anyhow, um, uh, has been using a relatively small number of IP and domain assets, um, until re- un- until just, like, the last couple week and then they’ve spun up more.

[00:15:53] Paul McCarty: But, so it was relatively easy to, to see them, um, you know, make these most recent changes. But, um, the, um, the, they were dropping these security audit YAML files into the workflow, and that’s how the PolinRider nature of this ex- And there’s actually three versions of that file all with slightly different names that are, that…

[00:16:15] Paul McCarty: But then you saw the threat actor writing new, you know, updating it in, in near real time. Um, so it’s been a very, very flowy thing. And then they registered, then when they changed the IP address to this 199 address, IP address, you know, about a month ago- Mm-hmm … or whatever it was, they then, um, registered a new domain, my-github.com, and oh boy, the fun just began.

The GhostAction phishing kit gets past GitHub MFA

[00:16:43] Jenn Gile: Yeah. Well, so part two of that, uh, we got a message from one of our community members, right? Loganaden reached out to you-

[00:16:51] Paul McCarty: Yep.

[00:16:52] Jenn Gile: Yeah … and, um, let us know, and I’m, uh, you can tell more of the story I suppose, but essentially, um, this campaign has started phishing open source maintainers, sending very convincing looking emails, um, saying, "Oh no, there’s a new sign-in from Moscow, Russia.

[00:17:10] Jenn Gile: Click now, secure your account." And it’s, uh, going to that my-github.com URL.

[00:17:19] Paul McCarty: Yeah, and then it’s just running the kind of typical proxy in the middle where, you know, it basically takes the username and password that you put in and, and sends it over to GitHub, um, and logs you in successfully, and then in the, in the mean…

[00:17:31] Paul McCarty: in, you know, steals your credentials. I mean, this is older than God, right? Um, but it- I actually tested it with, um, some of the MFA mechanisms that GitHub supports, and it actually very successfully, um, dealt with those MFA requirements. I was very impressed. And so this is… I, I said in the blog post, frankly, this is probably the best, uh, GitHub phishing kit that I’ve seen so far.

[00:17:59] Paul McCarty: But just to stop and kind of zoom back out, we’re talking about the same threat actor is now doing GitHub actions based worm-like, not a worm, but like a worm, right, behaviors, like- Caterpillar? … supply chain attacks. I don’t know. Yeah, right. Uh, anyhow, um, they’re doing that, and then they’re also doing phishing, right?

[00:18:18] Paul McCarty: And it’s all going back to the same IP address. And then it got even more interesting.

[00:18:24] Jenn Gile: Yeah. Well, the even more interesting is gonna be the teaser that we leave you with. Um- I was hurriedly trying to research it and ran out of time before today’s, uh, taping, but I… the, the tease that I will give is another one of our community members, while doing a routine hunt, found something really interesting, and I hope to have a blog published about it later tonight, and we’ll talk about it next week.

[00:18:50] Jenn Gile: Um, but I think you and I, um, have a lot of- interest in attribution on this, and I think you and I, we haven’t gotten a, a, like, much of an opportunity to talk about it, but I think we agree at this stage there’s nothing pointing, like, a solid “We think we know who we did this.” Or have you, have you uncovered something that I haven’t gotten the down low on yet?

[00:19:15] Paul McCarty: There’s been some updates- Okay … which I’ll, we’ll talk about- We’ll chat … offline. Yeah. Okay. I got a… It’s gonna be a pain in the butt, but yeah, so there’s, there’s updates.

[00:19:25] Jenn Gile: Okay. So

[00:19:25] Paul McCarty: more to

[00:19:26] Jenn Gile: come.

[00:19:27] Paul McCarty: Um, and more to come. And just really quickly, as an addendum, if you check the IP addresses that are involved, there’s only been two.

[00:19:33] Paul McCarty: These have been doing mass scanning for, you know, like, a, a year. So the whole, when GitGuardian identified, um, the, the GhostAction, um, uh, attack in 2025, that IP address was busily scanning, you know, GreyNoise and everybody else has a ton of data about this, right? Um, and it continues to do so. So not only are they doing phishing and software supply chain attack, but they’re doing mass outbound recon, you know, ostensibly looking for-

[00:20:00] Jenn Gile: Poked.

[00:20:01] Jenn Gile: We know

[00:20:01] Paul McCarty: somebody- Yeah.

[00:20:01] Jenn Gile: Yeah … who got poked, so yeah.

[00:20:04] Paul McCarty: Well, and yeah, and we know somebody else that also got phished too as well, right? So, like, now it’s not just Loganaden, it’s we, we have multiple people inside of our network. And so that makes us think if we already have, you know, two or more people inside of our network that have seen this, you know, what’s the actual, you know, real nature of this out in the wild?

[00:20:22] Paul McCarty: And it’s gotta be pretty big. Um, I think this, the, this is such an interesting case to me. Um, I’m going deep on it, so I’m excited.

[00:20:31] Jenn Gile: Yeah, and I guess the thing that I’ll leave with is I have not seen a lot of chatter about this on the interwebs, like, other than Socket and Step publishing some research last week and us publishing ours.

[00:20:46] Jenn Gile: It’s quiet, and you know, I, this is pure speculation, but is it because it’s GitHub Actions and fewer people understand it and understand the risk? That’s my thought. Um, but yeah, it’s, it’s surprising to me that this is not a bigger deal right now.

[00:21:02] Paul McCarty: Right? You know, to that point, exactly, I had the exact same thought, Jenn.

[00:21:07] Paul McCarty: I thought, “Well, maybe because this is CI based, you know, this is, this is where people get lost,” right? But then they did the phishing thing, and I thought, “Oh, like all the SecOps and, you know, and, you know, uh, InfoSec people will be interested.” And like, it’s one of my least popular posts, you know, like in the last year.

[00:21:23] Paul McCarty: Uh, you know, it’s for whatever reason, GhostAction is not getting any play. Um, which is unfortunate. It doesn’t mean that the threat is any smaller than anything else. Quite the opposite actually. But yeah. Yeah. You know, you and I can’t control

[00:21:36] Jenn Gile: that. More to come. That’s all I got right now.

[00:21:38] Paul McCarty: Yeah, exactly. D- there’s a lot more to come with this one, so for sure.

DOJ seizes 187 devices from North Korean IT worker laptop farms

[00:21:42] Jenn Gile: Okay, last topic, um.

[00:21:44] Paul McCarty: What is

[00:21:45] Jenn Gile: the last one? You flagged this for me. I’d already seen it. Uh- Oh, yeah … the US Department of Justice, uh, published a press release, what, two days ago? Yeah. Um, about the North Korean IT worker scheme, saying that they have worked, um, and I know I saw other posts, so I think like Cloudflare and others were involved, on a takedown of, um, laptop farms.

[00:22:09] Jenn Gile: So it says, uh, there were, uh, law enforcement actions in Ohio and Texas resulting in charges, arrests, seizures of approximately 187 computers. Um, I appreciate that the code name for this was Operation Lonestar Roundup. I, I would like some naming… I’d, I’d like to code name an operation.

[00:22:30] Paul McCarty: Oh, speaking of which- It would

[00:22:31] Jenn Gile: be super fun

[00:22:32] Paul McCarty: look what I wore.

[00:22:33] Jenn Gile: Oh, is that your last con?

[00:22:34] Paul McCarty: That’s my last con. That’s the, the, um, upside down, uh-

[00:22:38] Jenn Gile: I

[00:22:38] Paul McCarty: love it … scratch shirt. I wore it 'cause we talked about it last week.

[00:22:41] Jenn Gile: Yep Uh, yeah, I don’t know if there’s a whole lot to say on this other than it’s nice to see progress, um, that clearly this is not just something the security community is talking about.

[00:22:57] Jenn Gile: Um, I think continuing to swat down laptop farms has gotta be a hard job. Um- Totally agree … they can spin up more in other places. It doesn’t have to be in the US. They can find friendlier jurisdictions, or if not friendly, then, uh, places where it’s harder for law enforcement to do something about this behavior.

[00:23:20] Paul McCarty: I think w- my biggest takeaway from this, having had to do a lot of disclosure to law enforcement over the years, is like please make it easier for people to, like, to disclose this stuff to you. And this is the case in Australia, too. It’s even worse here. Like, like please, you know, you’re spending all this time making these big announcements.

[00:23:38] Paul McCarty: Make it easy for us to let you know when we find this stuff, right? It’s super frustrating that it’s as difficult as it is. Um, yeah, I mean

[00:23:47] Jenn Gile: Yeah, and I guess I should say, I don’t think I actually said what the malicious activity was that these laptop farms are behind. So in case you’ve missed it, um- Mm

[00:23:56] Jenn Gile: the scam is, uh, North Korean operatives, uh, apply for just about every remote job that’s out there. It’s not tech jobs only. I’ve seen data on this. Only about half of them are tech jobs. And, um, if they manage to get hired, then they use these laptop farms to appear like they’re, you know, in the place that they say they are.

[00:24:23] Jenn Gile: So there’s lots of proxying going on. It’s obfuscating their locations. And so they pay people. Um, the To Catch a Thief podcast did a really, really nice interview of a young woman who had unknowingly, supposedly, um, hosted a laptop farm. And-

[00:24:42] Paul McCarty: In Michigan.

[00:24:43] Jenn Gile: Yeah, I mean, they’re, they’re good at finding desperate people.

[00:24:46] Jenn Gile: Uh- Yeah … in the case of this one, they had found her, I think, through Reddit, like people looking- They did, yeah … for side jobs. Um, so this is… It’s a symptom of where we are economically, that people need this kind of money and are willing to look the other way for something a little sketchy so they can have some guaranteed income.

[00:25:07] Paul McCarty: Yeah. That’s… And just to kind of double-click on that, like, if you, if, if a North Korean operative gets a job with, let’s say, Facebook, Facebook is gonna send them this package, right, that includes a laptop and swag and stuff like that. And if they send it to China, well, guess what? That’s a big that’s a big red flag.

[00:25:24] Jenn Gile: That’s a tell.

[00:25:25] Paul McCarty: So they… That’s a tell. Send it to Kansas. So they s- yeah, they send it to some, you know, nice residential location in Kansas or Oklahoma or Arkansas, wherever the case may be, Michigan. Um, and these people are paid by DPRK. Uh, and by the way, there’s other threat actors that do this too as well.

[00:25:40] Paul McCarty: The, the Russians, for example, are, have been known to do this. Um, so yeah, I, I think just kind of on, that you have, you bring up a great point. I always jump ahead and talk about the, the technical part of it, but yeah, you know, they need a base of operations that’s in the US. If they see inbound connections from, like, Astrill VPN IP addresses, then that’s another red flag, right?

[00:26:00] Paul McCarty: So if instead they see something coming in from an AT&T in Indiana, well, that looks like what they expect to see, right?

[00:26:06] Jenn Gile: Yep. And, uh, there’s cases that we’ve heard more recently of people, I guess, kind of, uh, playing along with these scam interviews to see how much they can get out of them. So this is… I mean, I think the good news here is North Korea’s place in cybersecurity, like there’s a light being shone on it, that it’s not- Yeah

[00:26:33] Jenn Gile: able to hide, um, what’s going on. But, you know, we still don’t see a lot of awareness in other areas, so.

[00:26:41] Paul McCarty: Yeah. It

[00:26:41] Jenn Gile: is what

[00:26:41] Paul McCarty: it is. Agreed. Agreed.

Wrap up

[00:26:44] Jenn Gile: Okay. Well, that’s, I think, all we have for today. Did you have anything you wanna yolo before we wrap up?

[00:26:51] Paul McCarty: I always do, but no, let’s keep it, let’s keep it tight, uh, this week and, um, and we’ll, we’ll ramble on next week.

[00:26:57] Jenn Gile: Cool. Well, uh, hope everybody out there in inner land- internet land is doing great and, uh, we’ll see you next week.

[00:27:05] Paul McCarty: Indeed. Thanks for listening. And Jenn, be safe on your travels, yo.