Widely used managed phishing campaign and training provider, KnowBe4, recently encountered a security incident involving the hire of a fake IT employee. The company went through the usual hiring process when looking for a software engineer for its internal IT AI team; however, shortly after the new hire – planning to work virtually – received their Mac workstation, the company’s security systems detected malware being loaded onto the device.

The vetting process seemed thorough:

• HR conduced four video interviews
• HR verified the interviewee’s identity against provided documentation and photos
• A background check was performed
• References were checked

The attacker was able to complete the hiring process using a stolen U.S. identity and an AI-enhanced photo. When the company’s EDR software flagged the issue, the Security Operations Center (SOC) got support from Mandiant and the FBI to initiate a deeper investigation immediately. Results proved the new hire was a North Korean operative. The hacker was aiming to manipulate session history and install unauthorized software using a VPN to disguise their presence. The critical importance of vigilant security measures practiced within KnowBe4’s swift response prevented any data breach or significant damage.

Security measures are imperative for ensuring the safety of your business in events like this. Training employees to recognize social engineering tactics is crucial, but it is not the only step. A simple, yet effective, preventive measure is to require all employees – particularly those working virtually – to attend the final round of interviews in person. This helps prevent potential hires from misrepresenting themselves as shown in the KnowBe4 case.

Having robust incident response (IR), business continuity (BC), and disaster recovery (DR) plans are essential in order to maintain operations during a crisis. These plans should be regularly tested through tabletop drills and exercises to ensure they are effective and allow rapid pivoting and response in the event of an attack.

BACK TO BLOGS