How are North Korean state-affiliated actors leveraging deepfakes, proxies, and VPNs to conceal their identities when applying for remote IT roles? Is it only North Korea or other countries as well?
Okta’s threat intelligence team began seeing real signs of this threat in May, well before the RCMP’s joint advisory. North Korean operatives are using a mix of generative AI, deepfake video tools, encrypted communications, and VPNs to create entirely fake professionals who can apply for and secure remote IT roles. These fake candidates show up with polished résumés, AI-generated cover letters, and sometimes even deepfake video during interviews.
Once in, these actors can quietly extract data, install remote management tools, or reroute company assets. These types of threats are typically from sanctioned countries that are looking to find ways to subsidize whatever their government is doing.
What are the key warning signs Canadian companies should look for to avoid hiring freelance IT talent linked to sanctions evasion or espionage? What are the processes in place already to avoid these?
Some of the red flags include if someone is always avoiding live video, prefers text-only communication, or makes last-minute requests to change payroll details or shipping addresses. Those are signs that something could be off. Technical checks can also help. If a security team is looking at where someone’s working from, and it’s not the place they said they’d be – that’s a red flag.
Implementing safeguards tools like MFA, endpoint monitoring, and secure onboarding flows is also key. But what we’re pushing for is identity verification as a standard part of hiring. At Okta, we require all new employees to show up at an office within their first month. One way or another, we verify you are who you say you are.
From your experience, what best practices can Canadian businesses adopt to build secure and trustworthy IT hiring pipelines?
The best defense is to catch fraud early, at the very start of the employment lifecycle. First, train your HR teams. Knowing what to look for in resumes, interview behaviors, and communication preferences can go a long way. Then embed identity verification into your hiring process.
Background checks still matter, but they need to be paired with technical controls. Monitor for the unauthorized use of RMM (remote management and monitoring) tools, especially on corporate endpoints. Keep an eye out for login anomalies or mismatched time zones. Finally, loop your security team into the onboarding process.
How is AI, including generative AI, changing the tactics of state-sponsored cyber operatives targeting organizations worldwide?
We’re in a new era where generative AI is powering scalable, multi-layered fraud. For adversaries like North Korea, it’s a way to amplify their reach and sophistication, without needing a large team on the ground. They’re using GenAI to build realistic personas and manage dozens of job applications through a single interface. Once employed, some are even using AI to manage multiple simultaneous roles and communications, effectively turning job fraud into an operation that funds a sanctioned regime.
These tactics hurt trust in the hiring process and put companies at real risk of data exfiltration, IP theft, and even unintentional sanctions violations.
Your comments on the future of Cybersecurity in the next 5 years?
In the next five years, cybersecurity will be defined by identity. As attacks grow more sophisticated, especially with AI in the mix, the old perimeter is gone. We’ll see a shift toward identity-first security, where verifying who you are is the most important defense. Companies will need to move fast, embrace passwordless tools, and stay ahead of threats that are evolving by the day.
About Matt Immler – Matt Immler is the Regional Chief Security Officer for Okta in the Eastern Americas, where he leverages his Identity expertise to drive customer success. Matt’s background includes Auth0 Security and Compliance, in addition to previous roles in information security, network operations and software engineering. His educational achievements include a Bachelor of Computer Science from the University of Maryland Baltimore County and a Masters in Information Technology Management from the University of Maryland Global Campus. In his downtime, Matt enjoys volunteering at a local theatre company in support of his kids. Linkedin
