The Attacker on Payroll: A Spycatcher's View of North Korean Infiltration

North Korea-linked operatives don't need to phish their way in. The attack starts with a job application. They pass the interview, clear the background check, and arrive with valid credentials, valid MFA, and day-one access to source code. Abnormal AI's threat intelligence team has tracked this operation from the inside: roughly 3,500 fraudulent personas flagged, live interviews run by our analysts, and 100+ actors linked through reused infrastructure, network egress, and persona artifacts.

In this session, Abnormal's Chief Information Officer sits down with the former FBI counterintelligence operative who went undercover to help capture Robert Hanssen, the most notorious spy in U.S. history. They'll trace the North Korean operation from identity creation to authorized insider access, explain where standard screening breaks down, and identify the signals that surface before access is granted.

In this webinar, you'll learn: - How North Korea-linked operatives build personas that pass interviews and background checks - What roughly 3,500 flagged fraudulent personas and 100+ linked actors reveal about the operation - Where standard hiring and identity screening breaks down — and why credentials alone look valid - The signals that surface before access is granted, from reused infrastructure to network egress

Register today!

Earn ISC2 CPE (1 credit) This webinar is ISC2 CPE eligible. Submit the credit form to claim your continuing-education credits.