Name: North Korea: IT Worker Infiltration
Start: 2024-10-03T16:15:00Z
End: 2024-10-03T16:15:16.000Z
Location: BrightTALK
Rating: 5

We help protect organisations from today’s most pervasive cybersecurity threats. With us on your team, you’ll rest easy knowing your mission-critical assets are safe from threat actors.

As organizations look to build the right security operations strategy for their business, they often need to evaluate tradeoffs between consolidating on a single technology stack vs an open platform. Join SVP of Product Management, Kyle Falkenhagen, as he discusses the concept of taking an open approach to cybersecurity and what to consider when executing your security vision for the next 3-5 years.

What We'll Cover:
 -- The definition of an open cybersecurity approach to security operations
 -- Advantages to using an open framework, such as maximizing the value of your security investments today for flexibility in the future
 -- How to evaluate where and when to consolidate

Let's Talk SOC: Ep 22: Taking an Open Approach to Cybersecurity

An organization’s security strategy is an enterprise-wide business decision that requires understanding your risk profile and how you would respond in the event of an attack. Join VP of Marketing Stacy Leidwinger as she discusses the top elements to raise hygiene, the biggest risks, and the importance of aligning business and security teams.

What We'll Cover:
 -- Three core tasks to elevate security hygiene
 -- The top vulnerability and risk factors
 -- The impact of cybersecurity spending and cyber insurance

Let's Talk SOC: Ep21: Risks and Ramifications of Cyberattacks

As threat actors continue developing new ways to target organizations, it’s critical for security leaders to have the right threat intelligence and know how to use it. Join Director of Governmental Partnerships and Director of Threat Research at Secureworks Alexandra Rose as she discusses what threat intelligence is, why security leaders need it, and how they can use it to reduce organizational risk and respond to threats.

What we'll cover:
 -- Why it’s crucial to have threat intelligence
 -- How threat intelligence informs strategic decision making for security leaders
 -- How leaders can maximize intelligence to reduce risk
 -- What emerging threats should leaders know and how to prepare their organizations to respond

Let's Talk SOC: Ep20 - The Value of Threat Intelligence for Security Leaders

Managed Detection and Response (MDR) solutions deliver powerful threat monitoring, detection, investigation, and response capabilities. But in an ever-evolving threat landscape, organizations need more proactive capabilities to stay ahead of threat actors. Join us for this webinar, hosted in collaboration with QKS Group, to explore how MDR can go beyond the basics of traditional threat detection. Get the Secureworks perspective on MDR solutions and how they should proactively identify potential threat exposure. And discover the types of preemptive measures that mitigate risk and fortify cyber resiliency before a threat actor strikes.

In this informational webinar, you will:
 -- Learn how proactive features can accelerate the impact of MDR solutions
 -- Discover the role AI plays in driving efficiency in threat detection, investigation, and response
 -- Get insights into why it’s important MDR vendors understand your security priorities and goals

Shift Beyond Threat Detection to Proactive Measures

Over the past year, the North Korean IT worker scheme has adapted with deepfakes and AI, revealing new layers of deception. In this Cyber Short, the team will shed light on the intricate workings of state-sponsored groups like NICKEL TAPESTRY.

The Secureworks team discuss how these groups are innovating fraud tactics and what it means for organizations worldwide.

Secureworks Cyber Shorts: North Korean IT Workers: Unraveling Deeper Fraud

Discover how North Korean cyber threat actors are infiltrating organizations worldwide by posing as legitimate IT professionals. Join Secureworks CTU™ experts as they delve into this emerging threat, uncovering the latest developments in ongoing infiltration schemes. This webinar will detail the unique approach and toolset observed in incidents where DPRK nationals have fraudulently gained employment at unwitting organizations.

In this informational webinar, you will: 
 -- Gain insights into how infiltration schemes operate
 -- Explore the warning signs for fraudulent job applicants
 -- Learn about preventative measures to avoid hiring fraudulent DPRK workers

Inside the Threat: Secureworks CTU Analysis | Episode 5: Unmasking North Korean IT Worker Infiltration Schemes

With a 30% increase in new ransomware groups last year, organizations need comprehensive security solutions to stay ahead of cyber threats. Join us for an insightful webinar, hosted in collaboration with Frost & Sullivan, to take a deep dive into the extended detection and response (XDR) landscape. Get the knowledge and tools you need to evaluate solutions effectively, prioritize essential capabilities, and maximize the value of your investment post purchase. Whether you're in the process of selecting an XDR solution or looking to enhance the effectiveness of your current deployment, this webinar will provide you with actionable strategies and expert guidance to strengthen your security posture.

In this informational webinar, you will:
 -- Get expert insight on current market trends, key players, and the critical features that differentiate leading XDR solutions
 -- Learn how to assess XDR solutions based on your organization's unique needs, including integration capabilities, scalability, and ease of use
 -- Discover which XDR capabilities are essential for your security posture and how to prioritize them to address your most pressing security challenges
 -- Gain best practices for deploying and optimizing XDR solutions to ensure you get the most out of your investment

Maximizing Your Security with XDR: Essential Strategies and Guidance with Frost & Sullivan

Watch for an insightful Predictions Round Table with Secureworks experts as they delve into the future of cybersecurity in 2025.

Our Counter Threat Unit research team, featuring Rafe Pilling, Chris Yule, and Sarah Kern, and joined by Stacy Leidwinger, will explore the most significant threats on the horizon—from ransomware to state-sponsored adversarial tactics.

Learn how your business can stay ahead and be proactive in cyber preparedness.

Secureworks Cyber Shorts: 2025 Predictions Round Table

This episode of Cyber Shorts dives deep to decode the hype around deepfakes.

We unravel insights on how deepfakes are being used in robo-calling in the US, assess their prolific nature and advancement, discuss the potential risks they pose to organizations and consumers, and provide tips for identifying a deepfake.

Secureworks Cyber Shorts: Behind the Deepfake Hype

In this episode of Cyber Shorts, we take a deep dive into the takedown of the prolific ransomware group LockBit. We share the latest update around the takedown, its impact on cyber crime, and advice for organizations to remain cyber safe from ransomware.

Secureworks Cyber Shorts: LockBit: The Ransomware Takedown

China's Cyber Espionage Tactics Exposed. Learn how the latest sanctions impact global security and what your business must do to shield itself from the silent cyber war.

Secureworks Cyber Shorts: China and Cyber Espionage: Understand the Threat

The Secureworks® Counter Threat Unit™ (CTU) research team analyzes security threats to help organizations protect their systems, people, and data. 

Watch this Cyber Shorts with Stacy Leidwinger and Alexandra Rose to hear the top three insights around cybercrime, multi-factor authentication bypassing techniques, and malware in unauthorized downloads.

Secureworks Cyber Shorts: The Latest in Cyber Threats: MFA Bypass and Malware from Suspicious Downloads

Secureworks Counter Threat Unit™ Senior Security Researcher, Mark Osborn, examines China’s ongoing use of cyber intrusions to further its political, military, and economic aims. Mark sheds light on the use of cyber for intelligence collection by the Chinese state, taking a high-level look at the Chinese cyber threat landscape and digging down into specific examples of threat groups and their targeting methods. He also examines the role of the Chinese Communist Party (CCP), the main driving force behind intelligence collection.

In this informational webinar, you will:
 -- Learn about the structures in China responsible for cyber intrusions
 -- Gain insight into the evolution of China’s intelligence collection operations
 -- Discover whether your organization could be a prime target for Chinese espionage

Chinese Cyber Threats in the Age of the Xictionary

Secureworks® CTU™ experts provide an update on Operation CRONOS, the ongoing law enforcement disruption of one of the largest and most prolific ransomware groups of recent years, LockBit. This webinar will build on the detail provided in Episode 1 of Inside the Threat by discussing the most recent law enforcement action which uncovered links between LockBit and notorious Russian cybercriminal group, EvilCorp. 

CTU researchers will also look at the impact of this latest phase of Operation CRONOS on both the operators of LockBit and the wider ransomware ecosystem, providing practical advice for safeguarding your organization from ransomware.

In this informational webinar, you will:
  -- Gain insights into the latest developments in the ongoing disruption of LockBit and the newly discovered links to EvilCorp. 
  -- Discover how continued law enforcement activity has impacted the wider ransomware ecosystem and what this means for the threat landscape. 
  -- Learn how to protect your organization from ransomware attacks.

Inside the Threat: Secureworks CTU Analysis | Episode 4: LockBit Disruption Update

The Secureworks Counter Threat Unit researchers have identified a growing threat: Adversary-in-the-Middle (AiTM) attacks. These sophisticated threats are on the rise, and it’s important to understand them to defend against them.

Watch this Cyber Shorts as Rafe Pilling and Stacy Leidwinger dissect the mechanics of AiTM attacks, their implications, and actionable steps you can take to safeguard your organization.

Secureworks Cyber Shorts: The Rise of Adversary-in-the-Middle Attacks

Many mid-market organizations face security-specific challenges as they grow. It’s not easy protecting an increasingly unique and complex environment without enough resources or staff to confidently keep up with the threats they are facing. So how can these organizations change from reactive to proactive to increase their vigilance, improve their resiliency, and gain strategic guidance to elevate their security programs? Unfortunately, many managed detection and response (MDR) solutions fall short of being able to provide a flexible and holistic solution that doesn’t break their cybersecurity budget.

This on-demand webinar covers the challenges mid-market companies face, what a more tailored MDR solution should deliver, and how Secureworks® Taegis™ ManagedXDR Plus builds on the strong foundation of MDR for significantly less than it would cost to accomplish similar outcomes internally.

How to Tailor Security with Limited Resources

In the last year, 90% of organizations have suffered identity breaches as cyber attacks involving identities grow more sophisticated and widespread(1). Organizations rely heavily on their identity infrastructure to enable collaboration, remote work, and access to internal systems. But the complexity and room for gaps and errors in these systems make it an attractive target for threat actors, posing significant risks across all sectors.

To manage user identities and control access to resources, most organizations use identity and access management (IAM) systems. It's not enough. Analysis of these systems uncovered that 95%(2) are misconfigured. These misconfigurations provide cybercriminals with opportunities to escalate privileges and leverage identities to further their attacks. While IAM systems are crucial to an organization's security strategy, they must be complemented by additional security layers to proactively combat these tactics. Identity threat detection and response (ITDR) can provide these additional layers, identifying risks and anomalies and detecting potential breaches early.

In this informational webinar, you will learn:
 • The current state of identity threats and the expanding identity attack surface
 • Why organizations benefit from identity threat prevention as well as detection and response
 • How ITDR can help safeguard against the escalating risks associated with identity threats

Sources:
1. Identity Defined Security Alliance (IDSA), 2023 Trends in Securing Digital Identities, July 2023
2. Calculated based on existing Secureworks customer data gathered from incident response

Stop Identity Attacks in Their Tracks: A Roadmap to Risk Reduction

From opportunistic cyberattacks to state-sponsored threats, join this webinar to learn the latest tools, tactics, and motivations behind today's cybercriminal threats.

By understanding the motivation of today’s cybercriminals, your organization will have the insight they need to build a blueprint for cyber resilience. Learn how to take a more effective and efficient approach to prevention, detection, and response to reduce your cyber risk.

This Informational Webinar will cover:
 • Threat actor behavior and motivation to help understand the latest trends in cybercrime
 • Real-world examples of how organizations have both fallen victim to and protected themselves from threats
 • How to strengthen your cyber-resilient programs with managed detection & response (MDR)

Build a Cyber-Resilient Organization: Know the Threat to Beat the Threat

When it's your job to dive deep into the world of cybercrime every day, the ethics of what you do and how you do it matter more than ever. In this session, we'll explore the ethical challenges that arise in eCrime research, delving into the complexities of handling sensitive data, engaging with threat actors in underground forums, and the legal and moral responsibilities when collaborating with law enforcement agencies. Attendees will gain a deeper understanding of how to navigate these challenges while maintaining the integrity of their research and protecting the rights of all involved parties.

Ethical Considerations in eCrime Research

As trends evolve in underground stealer markets, what are the implications for the cybersecurity landscape?  We’ll examine how these illicit markets operate, the latest tactics threat actors are using, and the risks they pose to organizations worldwide. Attendees will leave with a clearer understanding of the threats emerging from these underground networks and how to defend against them.

Underground Stealer Markets: Trends and Threats

How do adversaries move from discussing proof-of-concept (POC) exploits in underground forums to exploiting Common Vulnerabilities and Exposures (CVEs) in the wild? Drawing on incident response data and underground research, we’ll explore how vulnerabilities are identified, POCs are shared, and exploitation tactics evolve. Attendees will gain valuable insights into how threat actors weaponize vulnerabilities and the critical steps needed to mitigate these risks.

From Underground POC, to Exploited CVE: The Adversarial Pathway to Successful Exploitation

Transforming raw adversarial discussions into actionable human intelligence is critical to helping our customers outpace the adversary. In this session, we’ll break down the processes of gathering, analyzing, and synthesizing underground chatter into tactical, operational, and strategic intelligence. Viewers will learn how to convert fragmented conversations into insights that enhance security decision-making and response strategies.

From Underground Chatter to Actionable Intelligence: The Lifecycle of Human Intelligence

2024 has been the year of major botnet takedowns. How has the malware landscape shifted since? We'll highlight key changes observed in adversarial tactics and how these have shaped the way we track, analyze, and protect against modern malware threats. Attendees will gain insights into the evolving strategies needed to defend against this constantly changing threat environment.

Evolution of the Malware Landscape

In 2024, law enforcement takedowns of prominent ransomware groups have impacted the cybercrime ecosystem. Together, we’ll analyze how effective these actions have been in disrupting criminal networks and the broader implications for the threat landscape. Viewers will gain insights into the successes and challenges of using takedowns to combat cybercrime.

Law Enforcement Takedowns: How Effective Are They?

This session will delve into the intricacies of large-scale malware intelligence within the Secureworks® Counter Threat Unit™ (CTU™) ecosystem. We’ll explore how CTU’s comprehensive analysis capabilities assemble diverse data sources and simulate real-world scenarios to enhance threat understanding. Join us to uncover the challenges and advantages of managing and interpreting large volumes of malware intelligence, and how this approach strengthens our defensive posture against evolving threats.

Malware Intelligence at Scale: Assembling the Pieces of Large-Scale Malware Intelligence

Released in January 2024, D3Fck is a multi-stage downloader that leverages security-through-obscurity to deploy malware covertly. Marketed as part of a Malware-as-a-Service (MaaS) offering on Russian-speaking underground forums, the loader is linked to the "GhostBusters Team," a group of traffers specializing in malware distribution. This session will cover the key features of the D3Fck loader, its role in the cybercrime ecosystem, and insights into the actors behind its operation.

Inside the D3Fck Loader: A Deep Dive into Malware-as-a-Service

Building on the "D3Fck Loader: A Deep Dive into Malware-as-a-Service" session, this talk takes you behind the scenes of a leading malware researcher’s analytical workflow. We’ll explore the tools, techniques, and methodologies used to dissect complex loaders like D3Fck, providing insights into how researchers uncover, analyze, and respond to emerging threats.

Behind the Analysis: Unveiling the Workflow of Malware Research

Vulnerabilities in Microsoft Entra ID applications are dangerous to your business when exploited. The session will highlight key tactics and techniques used by threat actors to compromise applications, pivot across tenants, and maintain access undetected. Drawing from Microsoft’s response and ongoing investigation, we will discuss practical guidance for detecting and mitigating similar threats, providing actionable insights to enhance organizational security against sophisticated attacks.

Microsoft Entra ID Applications as a Breach Vector

Adversary-in-the-Middle (AiTM) phishing attacks have notably increased in the past year, requiring new focus in customer defense strategies. This session will discuss how attackers use email or messaging services to intercept and manipulate communications between users and legitimate services. We’ll also explore the Axios AiTM campaign and how tools like Evilginx have been leveraged in these attacks, along with practical strategies to detect and prevent this growing threat.

Adversary-in-the-Middle (AiTM) Attacks: What You Need to Know

This session will provide a comprehensive review of Russian hostile state cyber tradecraft, focusing on the techniques used in the Ukraine conflict and other global operations. We’ll explore how Russia’s military, intelligence agencies, patriotic proxies, and contracted private companies combine computer network exploitation with information warfare to project power. From the abuse of perimeter network devices and poorly protected accounts to the manipulation of social media platforms, we’ll examine both traditional and novel tactics used by Russian actors. Viewers will gain insights into how these strategies impact global cybersecurity.

Russian Tradecraft: A Year in Review

Take an in-depth look with us on the Contagious Interview campaign, a North Korean-led operation targeting freelance job candidates with malicious interview tasks. We’ll explore how threat actors use platforms like Fiverr, LinkedIn, and GitHub to infiltrate corporate networks, often by exploiting company-owned devices used by unsuspecting candidates. Attendees will gain insights into the campaign’s tactics, such as the use of malware-laden coding tasks and compromised video conferencing software, along with practical advice on how to defend against such social engineering threats.

A Freelance Job with a Side of Malware: Contagious Interview

Your ability to detect real threats quickly, without excess noise, is fundamental to protecting your business. Join us in this session to explore the comprehensive lifecycle of detection development within Taegis™, from initial research to real-world application. We’ll cover the foundational aspects of detection, including IOC-based, signature-based, and application-based detections, and how these are integrated into Taegis XDR. Learn about the CTU™  Detection Research team’s mission to embed threat intelligence into detection mechanisms to ensure top-notch protection. We’ll delve into the continuous R&D process, highlighting how we use a blend of open source, commercial, and internal tools to maintain high-fidelity detections and stay ahead of adversaries.

Detection Lifecycle: Research and Development of Taegis Detections

Join us for an in-depth look at a cyberattack's progression from initial infostealer deployment to the final ransomware outbreak, viewed through the lens of incident response professionals. We’ll explore how compromised data dumps led to credential theft, remote access, and privilege escalation, ultimately resulting in a ransomware attack. By examining real-world threat intelligence and leveraging dark web research, we will illustrate how the pieces were put together to understand and mitigate the attack. Attendees will gain insights into the challenges and strategies involved in responding to such complex, multi-stage incidents.

From Infostealer to Ransomware: A Hands-On Incident Responder Perspective

This session will explore how business impact analyses, risk assessments, and policy development collectively strengthen an organization’s cybersecurity. We’ll clarify the roles of policies and plans, show how risk assessments identify and prioritize risks to inform policy and plan creation, and demonstrate how business impact analyses ensure plans address critical functions and recovery priorities. By following a workflow from policy development to plan refinement, we’ll illustrate how these components work together to enhance preparedness and resilience against cyber threats.

Integrating Policies, Risk Assessments, and Business Impact Analyses for Robust Cybersecurity

Explore the anatomy of a typical compromise through the lens of an experienced pentester. By examining each stage of an attack, the session demonstrates how to effectively detect and counteract malicious activities. The insights provided will help identify critical touchpoints in the attack chain, enhancing the ability to catch intruders and strengthen overall security defenses.

60% of the Time This Will Catch a Hacker Every Time

Business Email Compromise (BEC) remains one of the most prominent attack vectors today. How did it evolve in 2024? In this session, attendees will gain a comprehensive understanding of BEC, from its fundamental concepts to the latest tactics employed by cybercriminals. The talk will cover how BEC techniques have adapted over time, highlighting recent trends and emerging threats. Key focus areas include new attack vectors, sophisticated social engineering methods, and the impact of evolving technologies on BEC strategies. By analyzing case studies and recent incidents, the session aims to equip participants with the knowledge to recognize, prevent, and respond to BEC threats effectively.

Business Email Compromise: What is it and how has it evolved in 2024?

Navigating the Cybersecurity Labyrinth: From Data to Defense.

Looking ahead to 2025, cybersecurity experts come together to discuss emerging threats and provide the latest insight into how to combat today’s adversaries.

The status quo is changing, and the stakes are high — join us in the frontline defense against the adversary.

Secureworks Global Threat Intelligence Summit 2024

This session will explore North Korean IT worker infiltration schemes, detailing known cases of fraud where DPRK nationals have posed as legitimate IT professionals to gain access to organizations around the globe. We’ll discuss how these actors operate, the risks they pose, and practical measures organizations can take to protect themselves from this growing threat.

North Korea: IT Worker Infiltration

Cyber Attacks

Cyber Defense

Cyber Threats

Cyber Security

Threat Defence

Threat Detection

Threat Hunting

Threat Intelligence

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The unexpected nature of natural disasters and other disruptive events means that preparation is key to managing disaster recovery and business continuity planning. Join the business continuity and disaster recovery community for live and recorded presentations discussing best practices for business continuity planning, disaster recovery programs and business continuity management. Learn from BCDR experts to develop your critical infrastructure and gain insight into tactical solutions to your BCDR issues.

Business Continuity / Disaster Recovery

Practicing business intelligence allows your company to transform raw data into sets of insights for targeted business growth. The business intelligence and analytics community on BrightTALK is made up of thousands of data scientists, database administrators, business analysts and other data professionals. Find relevant webinars and videos on business analytics, business intelligence, data analysis and more presented by recognized thought leaders. Join the conversation by participating in live webinars and round table discussions.

Business Intelligence and Analytics

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Get powerful insights to run your business. CEOs, CFOs, CMOs, COOs, CTOs and CIOs are among the leaders in this community who connect with peers and experts to grow their businesses.

CxO Strategy

In the business management community, commercial experts will be sharing webinars and videos on an array of subjects. From sales and marketing, to finance, productivity and growth, this content will help you stay up-to-date with the current economic environment and provide timely management insight to drive business growth.

North Korea: IT Worker Infiltration

Presented by

About this talk

Secureworks