The job offer that comes home

In 25 years in cybersecurity I have watched a lot of threats get filed in the wrong drawer. North Korea's fake-recruiter campaign is the current example. Most of what I have read treats it as a problem for software companies. It is at least as much a problem for the families around the people it targets.

On 18 September, police and intelligence agencies from Japan, the United States, Germany and Australia, including the Australian Signals Directorate, published a joint advisory on a group they call WaterPlum, also known as Contagious Interview. An attractive job offer arrives through LinkedIn or a similar platform, rapport is built over a few messages, and the candidate is asked to complete a coding test. Running the test installs malware. The agencies counted at least 30,000 compromised devices in more than 100 countries, funds or credentials taken from more than 7,000 cryptocurrency wallets, and at least US$10.71 million stolen.

ASD would not say whether any Australians were among the victims, so there is no local figure.

Where it lands

The advisory names its targets: web designers, engineers, and people who work in cryptocurrency and blockchain. That list describes people rather than companies. The device someone uses for a job interview is very often a personal one, on a home network, sitting alongside everything else the household does online.

An illustration, not a real case. A family's adult son works in software and has been quietly looking around. A recruiter gets in touch with a role that pays well and fits his experience. The second interview includes a short technical exercise, which he completes on his own laptop at home that evening. The same laptop holds his browser sessions, a small crypto wallet and the family's shared logins, and it sits on the same network as his parents' devices. Nothing about that evening would look unusual to anyone in the house. The same applies to a spouse who holds crypto, or anyone else in the family who fits the advisory's list.

The advisory says stolen data is used to take cryptocurrency, to impersonate the victim and, in its words, "for extortion".

The approach that takes months

In April a crypto trading business called Drift lost more than US$280 million to a different North Korean group. By Drift's own account, the attackers posed as a trading firm, met its people at conferences in several countries over six months, and put in US$1 million of their own money to look credible. The breach appears to have come through software that one of them was persuaded to install.

A family office, or any family investment company, is approached constantly by people who want to do business with it, and the most patient approach is the one that feels most like a relationship.

Whose job it is

The company's security team covers the company's devices. The family office's IT provider covers the office. Neither covers the son's laptop, the contractor who looks after the home network, or the counterparty who has been pleasant company at three conferences. Nobody in that list is doing their job badly. Each holds part of the picture and none of them is accountable for the whole of it, and that gap is where this campaign is built to work.

Somebody has to hold the household's side of it: who can reach into the home, who in the family is being approached, and whether anyone has checked. That is the work we do, alongside the IT provider and the lawyer rather than instead of them.

What a proportionate response looks like

Give it an owner. One named person who holds the whole picture, including the household and the people around it. Every other step on this list needs someone to do it, and each adviser reasonably assumes another one has it.

Keep tests away from the keys. A coding test, a shared repository or an app sent ahead of a meeting should never run on a device that holds a crypto wallet, a password manager or the family's shared logins. The advisory recommends a sandbox or a virtual machine. My advice is simpler: a cheap laptop used for nothing else.

Know who can reach into the house. Ask whoever installed the alarm, cameras, network or smart home system for their business name, ABN and the name of each person who can log in remotely. Switch off any access nobody can put a name to.

Treat an approach to anyone in the family as an approach to the family. Check a recruiter's or counterparty's history independently, and be wary of anything that asks them (the family member) to install software, copy an instruction into their computer, or download an update to get a video call working.

If something has run, assume the worst. The advisory's guidance is to disconnect the device, assume data has already gone, rebuild it, and move any crypto to a new wallet on a separate device with the recovery phrase kept offline.

The people running this campaign are patient and well resourced. They want the person whose access is useful and whose attention is elsewhere, and in most families that is someone other than the person with the money.

If nobody in the household holds that picture today, that is the gap I would close first, with your existing advisers or with us.

Craig Searle has spent 25 years in cybersecurity across banking, government, technology and critical infrastructure. He is a Founding Partner of Praetos, a private protective service for private clients and their families.