North Korean hackers pose as security firm to target researchers

In late March, Google's security team uncovered a new chapter in an ongoing campaign by North Korean hackers to infiltrate the world of cybersecurity researchers. The group, previously documented by Google's Threat Analysis Group in January, had been caught red-handed running a coordinated social engineering operation across multiple platforms. Now they were trying something different: they had created an entirely fake security company.

The operation, which Google researchers began tracking in January, relied on a simple but effective playbook. North Korean operatives would establish fake profiles on Twitter, LinkedIn, and Keybase, posing as fellow security professionals. They would start blogs, share videos of supposed research work, and engage with legitimate researchers in the community. The goal was to build enough credibility to seem like genuine peers in the field. Once they had established rapport, they would propose collaboration on cybersecurity research—a request that would seem natural to someone working in that space.

But the collaboration came with a trap. The hackers would send victims a malicious Visual Studio project file, or direct them to a blog post embedded with browser exploits designed to compromise their machines. It was a straightforward attack: gain trust, deliver the payload, gain access. Google's Threat Analysis Group, which specializes in tracking advanced persistent threat groups, documented the entire scheme and attributed it to North Korean state-sponsored actors.

By late March, the group had evolved. On March 17, they registered a domain called SecularLight.com and launched what appeared to be a legitimate security firm called SecuriElite. According to the company's website, it was based in Turkey and offered penetration testing, software security assessments, and exploit development services—exactly the kind of work that would appeal to security researchers looking for partners or employment. The website included professional branding and a team section populated with fabricated profiles of supposed employees.

One detail stood out: the site included a PGP public key link. While PGP keys are standard security practice for encrypted communication, Google's team recognized the tactic. The North Korean group had used similar links before as entry points to pages hosting browser-based exploits. Researchers clicking the link would find themselves compromised.

The fake SecuriElite team was equipped with a fresh set of social media profiles across multiple platforms. These accounts impersonated security researchers, recruiters from legitimate cybersecurity firms, and in at least one case, someone claiming to be an HR director at a company with a name suspiciously similar to Trend Micro, a real security vendor. The impersonation was precise enough to fool someone scrolling through professional networks.

Google's Adam Weidman, who leads the Threat Analysis Group, announced the discovery on March 31. The company immediately reported all the fraudulent profiles to the social media platforms hosting them and added the SecuriElite website to Google Safe Browsing, its database of known malicious sites. At the time of the report, the website had not yet been observed serving active malware, but Google treated it as a precautionary measure.

What made the discovery significant was not just the new tactic, but what it suggested about the group's capabilities and intentions. Google's analysis indicated that the North Korean operatives likely had access to multiple browser exploits, including ones targeting Internet Explorer. The shift from scattered fake profiles to a full corporate front suggested they were doubling down on the strategy, not abandoning it. Researchers in the cybersecurity field—the very people tasked with defending against such attacks—had become a priority target for a state-sponsored hacking operation.