Alongside our threat-hunting partner Crowdstrike Overwatch, we were able to confirm that the individual device was on the same network as known North Korean criminal hacking groups linked to stealing money from companies. We immediately activated incident response– evicting the user, collecting forensic evidence, and coordinating with law enforcement to assess potential damage. We helped the client change the credentials for all of their infrastructure services in synchrony, so the employee thought to be committing identity fraud would not be able to access any resources and thoroughly reviewed the client’s infrastructure logs to find any potentially malicious changes.
