Daily Briefing for 05.01.25

At a glance.

• Hundreds of Fortune 500 companies have hired North Korean operatives.
• SonicWall warns that VPN flaws are being exploited.
• France attributes numerous cyberattacks to Russia's APT28.

Hundreds of Fortune 500 companies have hired North Korean operatives.

WIRED has published a report on North Korea's efforts to obtain remote IT positions at foreign companies, noting that these fraudulent workers are now using AI tools to cheat on coding tests and technical interviews. The threat actors are also using deepfake technology to bypass ID checks. The primary goal of these workers is to earn a paycheck for Pyongyang, though they also occasionally use their access to conduct espionage or launch financially motivated attacks.

Researchers at Mandiant and Google Cloud covered this same topic in a media briefing at RSAC 2025, CyberScoop reports. Mandiant Consulting CTO Charles Carmakal stated, "There are hundreds of Fortune 500 organizations that have hired these North Korean IT workers." Carmakal added, "Literally every Fortune 500 company has at least dozens, if not hundreds, of applications for North Korean IT workers. Nearly every CISO that I’ve spoken to about the North Korean IT worker problem has admitted they’ve hired at least one North Korean IT worker, if not a dozen or a few dozen."

SonicWall warns that VPN flaws are being exploited.

SonicWall warns that two vulnerabilities (CVE-2023-44221 and CVE-2024-38475) affecting its Secure Mobile Access (SMA) appliances are now being exploited in attacks, BleepingComputer reports. SonicWall has updated its advisory to state, "During further analysis, SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking." The company added, "SonicWall and trusted security partners identified that 'CVE-2023-44221 - Post Authentication OS Command Injection' vulnerability is potentially being exploited in the wild. SonicWall PSIRT recommends that customers review their SMA devices to ensure no unauthorized logins."

France attributes numerous cyberattacks to Russia's APT28.

The French cybersecurity agency ANSSI published a report on APT28 (also known as "Fancy Bear"), a well-known threat actor tied to Russia's GRU. ANSSI has tied APT28 to attacks against French entities in the defense, aerospace, research, and financial sectors, as well as French government entities. The report notes, "In 2024, the victimology of the campaigns associated with the APT28 intrusion set primarily includes governmental, diplomatic, and research entities, as well as think-tanks."

France’s Ministry for Europe and Foreign Affairs said in a statement that it "condemns in the strongest terms the use by Russia’s military intelligence service (GRU) of the APT28 attack group, at the origin of several cyber attacks on French interests."