Responding to a DPRK ITW Incident

Update: 2025-05-19

Description

JP Glab (Mandiant Consulting) joins host Luke to discuss responding to activity from North Korean IT workers. He walks through what initially triggered the investigation at this organization, how it progressed in parallel with an HR investigation, and ultimately what was discovered. For more on the DPRK IT workers and trends in incident response, check out Mandiant's 2025 M-Trends report.

https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025

Comments

In Channel

AI Tools and Sentiment Within the Underground Cyber Crime Community

2025-08-1825:44

Protecting the Core: Securing Protection Relays in Modern Substations

2025-07-2843:05

The Rise of ClickFix

2025-07-1523:33

Vishing in the Wild

2025-06-0437:48

Responding to a DPRK ITW Incident

2025-05-1916:35

UNC5221 and The Targeting of Ivanti Connect Secure VPNs

2025-05-0527:55

Windows Remote Desktop Protocol: Remote to Rogue

2025-04-1434:27

Cybersecurity Conversations with the C-Suite and Board

2025-03-1036:14

What to Watch For in 2025

2025-02-2844:31

Signals of Trouble

2025-02-1926:03

Agentic AI in Cybersecurity

2025-02-0526:40

The Art of Remediation in Incident Response

2024-12-0240:59

How to Run an Effective Tabletop Exercise

2024-10-1829:14

Using LLMs to Analyze Windows Binaries

2024-10-0436:40

How Threat Actors Bypass Multi-Factor Authentication

2024-09-2627:20

TAG's Work Tracking Commercial Surveillance Vendors

2024-09-0423:58

What Iranian Threat Actors Have Been Up To This Year

2024-07-2536:13

Mandiant's Approach to Securely Using AI Solutions

2024-06-2732:00

Lessons Learned from Responding to Cloud Compromises

2024-06-0330:16

The ORB Networks

2024-05-2229:54

00:00

Responding to a DPRK ITW Incident

#box-pro-ellipsis-17570710124802{-webkit-line-clamp:2;}Responding to a DPRK ITW Incident

Responding to a DPRK ITW Incident

Mandiant

Responding to a DPRK ITW Incident