a clean background check means we know who we hired

what everyone assumed

Hiring has its own checks, and they are serious ones. Several interviews on video, a background check against a real identity, references from previous employers. Once a candidate has passed all of that, the company knows who it is employing, and the laptop, the accounts and the access that come with the job go to a known person.

what happened

KnowBe4, a company that sells security awareness training, described the case in a blog post on 23 July 2024. It hired a software engineer for an internal team. According to the post, the candidate passed four video interviews, a background check and reference checks. The background check came back clean because the identity was real and stolen. The photo the candidate submitted had been edited with AI.

KnowBe4 shipped a Mac. On 15 July 2024, at about 21:55 EST, its endpoint security flagged activity on the new account: manipulation of session history files, transfer of potentially harmful files and unauthorised software, with malware loaded through a Raspberry Pi, according to the post. The security team contacted the employee, who said they were following a router guide to fix a speed problem, then stopped responding. The device was isolated at about 22:20 EST.

KnowBe4 says no illegal access was gained and no data was lost or taken from its systems. It shared what it found with Mandiant and the FBI and says the worker was part of a North Korean scheme that places fake IT workers in Western companies, typically with the laptop sent to a so-called laptop farm and operated remotely from abroad.

how it surfaced

It surfaced because the person behind the account moved on the first evening and the endpoint tools on the laptop were watching. KnowBe4 published the case, updated the post in October 2024 with changes to its hiring process, and lists a laptop shipping address that differs from where the employee lives or works as a red flag.

Most companies have no reason to expect the same luck. In January 2025 the FBI warned that North Korean IT workers, once discovered, were stealing source code and data and demanding ransom for it. On 30 June 2025 the US Department of Justice said such workers had obtained jobs at more than 100 US companies.

A background check confirms that the identity exists. It cannot see who is typing.

The checks were done well, and each answered its own question. None of them asked whether the person at the end of the video call was the person on the documents.