PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Hiring also defines the perimeter: reviewing identities and remote access
Businesses need to connect recruitment, device delivery, authorization and offboarding. This assessment proposal uses evidence while protecting legitimate remote work.
By Pentesty
The official announcement behind this analysis
Cyber Security Brazil covered the operation announced by the DOJ on October 13. The department said a scheme attributed to North Korean IT workers affected more than 70 U.S. employers, using false or stolen identities and facilitators hosting computers in the United States. The charges still need to be proven. That day, the FBI issued guidance for businesses and warned against identification using a single indicator.
Verifying the person is only the beginning
Consider a fictional hire approved to develop a feature. The role needs one repository and a test environment, but the corporate account receives permissions inherited from a previous profile. Even when the identity is correct, that mismatch increases the impact of misuse. Start the assessment question with the actions necessary for the role and the resources they require.
We propose connecting the hiring record to an explicit set of permissions. Decide who approves each change, how device delivery is confirmed and which remote support tools are permitted. Another team should be able to verify the control without relying solely on the assessed person's own declaration. Our insider threat analysis connects physical processes with digital permissions and accountable owners.
Do not turn an accent, nationality or work outside the office into evidence of guilt. A discrepancy can have a legitimate explanation and deserves a proportionate investigation. Record the hypothesis, its supporting evidence, who may examine it and how an error is corrected. This improves decision quality and reduces conclusions based on impressions rather than observed behavior.
Test continuity across HR, IT and security
- Role scope: Create a fictional profile with defined needs. Compare approved permissions with actions actually available in repositories, applications and cloud services. Include exports and changes to relevant configurations, rather than checking account existence alone. Evidence: an access matrix and observed responses.
- Delivery and ownership: Simulate delivery of a test device. Check whether IT can connect receipt, an accountable owner and asset management. Document how a change of address or custody triggers another verification and who can approve an exception. Evidence: a delivery record and exception process.
- Permitted remote access: List authorized tools and their business purposes. In a lab, check whether the team detects an installation outside the list and investigates its context before concluding that misuse occurred. Keep the test within agreed boundaries. Evidence: the detected event, analysis and recorded decision.
- Role changes: Move the fictional account between two roles. Test whether previous permissions disappear when no longer needed. Depending on the architecture, also check service credentials associated with the work and any approval needed to retain them. Evidence: a before-and-after comparison and limitations.
- Offboarding and restoration: Terminate the test account's access and check sessions, tokens and scheduled tasks. Rehearse the handling of an incorrect block too, with authorization to restore only what is required and an audit trail for the decision. Evidence: observed revocation and controlled restoration.
The report should identify the broken transition
A list of suspicious names does not demonstrate that the access lifecycle works. Prefer findings that identify the failed transition, the team able to fix it and how to repeat the check. Our cloud identity and exposure article adds digital control context. For outsourced work, the vendor evidence checklist helps request reproducible deliverables. These are proposed Pentesty exercises, not tests of the employers mentioned by the DOJ.
Frequently asked questions
Does the announcement mean the defendants were convicted?
No. Announced charges still require proof and adjudication. The number of affected employers does not replace examining the evidence about each person or organization.
Does using remote support prove fraud?
No. There are legitimate uses. Check authorization, purpose, context and records, combining the available signals before making a decision about a person or activity.
Can HR conduct the review alone?
The assessment needs the people who approve identities, deliver assets and administer systems. Define responsibilities and share only the information each team needs for its part of the analysis.
Can a Red Team exercise include this scenario?
Yes, when objectives, participants, environments and boundaries are authorized. Use fictional identities and stop conditions, with specialists reviewing the results and stating remaining coverage limitations.
Sources and references
- Cyber Security Brazil: editorial news reference
- U.S. Department of Justice: remote IT worker announcement
- FBI IC3: IT worker threat guidance
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.