Deception (social engineering): IT service provider and software company, USA 2024
After interviews and background checks, KnowBe4 hired a software developer who turned out to be a North Korean operative using a stolen identity.
- Incident · 07.2024 · Florida (Clearwater), USA
- Evidence: confirmed by an authority
- Deception (social engineering)
- Deepfake
- Malware
- AI link
As of
What happened
As soon as the company Mac had been delivered, he began loading malware; endpoint monitoring raised the alarm on 15 July 2024. The device was isolated, and Mandiant and the FBI were called in.
Role of AI: The application photo was a stock photo «enhanced» with AI; the video interviews matched the photo.
- Affected
- KnowBe4
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- no / no
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Job application with a stolen US identity and an AI-edited photo; malware on the company Mac delivered
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
For remote hires, independently verify the identity and the delivery address for devices, and give new accounts only minimal rights.
Sources
- How a North Korean Fake IT Worker Tried to Infiltrate Us (opens in a new window) KnowBe4 · 2024-07-23 (Update 2024-10-19)
«No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems.»
- Cyber firm KnowBe4 hired a fake IT worker from North Korea (opens in a new window) CyberScoop · 2024-07