Stumbled him with a simple question about Halloween

Amfiring team in Krakek, in US Cripto Exchange, noticed immediately that something was in “Steven Smith”, it would not be a worker applied For the job of software engineering in early October. But until they compared Smith’s e-mail to the list of those who are suspected of being part of the hacker group that their doubts were confirmed: Smith was North Korean operative.

Kraken could only throw an application. Instead, Kraken’s The Security Council, Nick Percoco, decided to take a closer look at Steven Smith. It saw as an opportunity to find out more about the infiltration tactics North Korea, which robbed billions from CRIPTO companies and how it could prevent that happened to Kraken.

Percoco decided to advance Smith through the recruitment process, and it is to speak with recruiter and perform a technical test before establishing an interview. “We said it would be to meet you, somehow, a cultural interview.” Percoco said Happiness. “There really failed. I don’t think he actually answered any questions we asked.”

Smith claimed he graduated from computer science from New York University, according to a copy of his resume he reviewed Happiness. He also claimed that he had more than 11 years of experience as a software engineer in the US-based companies like Cisco and kind people.

The interview was scheduled for Halloween, a classic American holiday – especially for students at the College in New York – Smith seemed to know nothing about it.

“Be careful about tonight because some people can ring at the door, children with chainsaws,” Percoco said, referring to the tradition of tricks or treatment. “What do you do when these people appear?”

Smith shrugged and shook his head. “Nothing special,” he said.

Smith also failed to answer simple questions about Houston, in the city allegedly lived for two years. Despite mentioning “food” as interest on its resume, Smith could not think of a direct answer when he asked about his favorite restaurant in the area of ​​Hjuston. He looked around a few seconds before muttering, “nothing special here.”

Here are shots from the interview where Smith asked about his favorite restaurant.

When asked to produce a physical ID, Smith said he didn’t have access right now, but after a few minutes he shared a driver’s license with his name and photo. The address listed on the ID was over 300 miles from Houston.

Smith’s job job part is a growing threat faced American companies as thousands of that worker with north Korea relationships try to engage for remote work in foreign countries. The operatives network is part of efforts to finance a mass destruction program in operation by working several businesses at once and acquiring companies to steal money inside.

Growing threat

Kraken may have escaped the bullet, but some companies did not have so much happiness. United Nations estimates That North Korea generated between $ 250 million to $ 600 million a year by fraudulent companies to hire their spies. North Korean Network, known as celebrities, after 304 individual incidents last year, Ciberity Company Crowdstrike exportanticipating that campaigns will continue to grow in 2025. years.

CRIPTO has shown that it is especially vulnerable to this type of social engineering. Lazarus Group, the second North Korea network, is connected to some of the largest crypting heads in history, including breaking records $ 1.5 billion Cripto Exchange Bibits in February and theft of $ 540m from Ronin Network BlockCain 2022. Years.

Although Percoco does not know exactly what Smith’s intentions, he took over an operational intended to steal funds at some point. “They would get our company equipment, they would get access to some internal systems,” Percoco said. “What they would do after that, we don’t know, but she’s most likely trying to steal the means.”

This story is originally presented Fortune.com