The Insider Threat Model: How Nation-States Now Prefer Patience Over Exploits

A quiet shift in attacker behavior is reshaping how nation-state and financially motivated groups approach cybersecurity: rather than breaking into systems, many are simply getting hired into them, or embedding themselves so deeply that they become indistinguishable from legitimate operations.

01Fake resumes, real paychecks

Amazon alone blocked 1,800 fraudulent IT-worker job applications last year, all of which traced back to North Korea. These were not crude attempts — the applicants came equipped with stolen identities, fabricated employment histories, and polished LinkedIn profiles complete with verification badges.

DPRK-linked operatives have been systematically applying for remote developer roles at Western companies, then collecting salaries, gaining codebase access, and quietly exfiltrating data for months at a stretch before detection. More than 300 U.S. companies — including a number of Fortune 500 firms — have unknowingly brought these operatives onto their payrolls.

The scheme has since escalated. According to the FBI, some operatives now exfiltrate proprietary source code and hold it for ransom, threatening former employers with a public leak if payment isn't made.

Consider what that looks like from the inside: a new remote hire clears the technical interview, passes the background check, and delivers clean commits for weeks — all while quietly copying repositories to personal cloud storage, harvesting credentials, and mapping internal infrastructure, with the resulting paycheck reportedly funding weapons development.

02A new label for an old tactic

Picus Security's Red Report 2026, which analyzed more than 1.1 million malware samples and mapped 15.5 million adversarial actions from 2025, found that ransomware-related encryption events fell 38% between 2024 and 2025 — a statistic that reads as good news on its face but points to something less reassuring: attackers aren't encrypting less because they're failing; they've shifted to methods that work better without tripping alarms.

Credential theft targeting password stores now shows up in 23.49% of all attacks tracked, and roughly 80% of the top attack techniques identified in the report center on stealth, persistence, and evasion rather than destruction. Picus's own term for this category is "Digital Parasites" — intrusions that don't announce themselves, don't detonate, and instead settle in to feed on access and credentials for as long as they can remain unnoticed.

Taylor Monahan, a security researcher at MetaMask who has closely tracked North Korean operations, summarized the group's method plainly: "To date, we have never seen DPRK do, like, a real exploit. It's always: social engineering, and then compromise the device, and then compromise the private keys." No code-level exploit is required — only patience, deception, and time.

03State-level squatters

Nation-state actors have applied the same patient logic at a much larger scale. In January 2024, then-FBI Director Christopher Wray told Congress that Chinese cyber operations constituted "the defining threat of our generation" — a warning aimed not at ransomware crews but at long-term infiltration.

Volt Typhoon, a Chinese state-linked operation, had quietly embedded itself inside U.S. critical infrastructure networks for years before being uncovered — reaching into utility grids, communications providers, and transportation systems, all of which were found compromised.

Rather than deploying obvious malware, the group relied primarily on administrative tools already built into their targets' systems — PowerShell, WMI, and standard command-line utilities — to blend into routine network activity. Custom backdoors such as SockDetour served as fallback persistence if primary access was ever severed, and traffic was routed through compromised home routers and neglected, end-of-life devices no longer receiving vendor patches.

CISA's advisory made clear that this wasn't espionage aimed at stealing information — it was pre-positioning, embedding access deep enough to disrupt operations at a moment of Beijing's choosing.

A second campaign, Salt Typhoon, followed, breaching at least nine U.S. telecom providers, including AT&T, Verizon, T-Mobile, and Lumen. The attackers exploited CALEA systems — the lawful-intercept infrastructure used by law enforcement — to intercept calls and texts, including communications tied to both major U.S. presidential campaigns. Eighty countries were affected in total, and the FBI notified more than 600 organizations.

Senator Maria Cantwell's subsequent review found routers with security patches that had been available for seven years and were simply never applied. As of February 2026, experts believe remediation remains incomplete, with indications that Salt Typhoon actors may still retain access inside U.S. telecom networks.

Volt Typhoon's presence went undetected for roughly five years — surfacing only because investigators eventually went looking. China's incentive is geopolitical leverage; other state and quasi-state actors pursue the same patient access model for financial gain instead.

04The employment pipeline as an attack surface

North Korean operators have effectively weaponized both sides of the hiring process. Beyond seeking employment themselves, they also pose as recruiters — a campaign researchers call Contagious Interview, active since 2023 — reaching candidates on LinkedIn with attractive job offers from what appear to be legitimate crypto companies, then guiding them through a fabricated interview process.

One stage of that fake process typically asks candidates to complete a technical assessment: clone a GitHub repository and run npm install. The repository carries malware known as BeaverTail or InvisibleFerret, which opens a backdoor, steals stored browser credentials, and drains any accessible crypto wallets — with candidates unknowingly executing the payload themselves in their eagerness to impress a fictitious interviewer.

Taylor Monahan has also been tracking a separate technique for months: a fake Zoom or Teams meeting scheme. Attackers first hijack a trusted Telegram account — frequently belonging to a venture capitalist or someone the target previously met at a conference — and use the existing chat history to arrange a video call via a Calendly link.

When the victim joins, they see what appears to be a live video feed of their contact. In reality, it's looped footage taken from real past hacks or public sources such as podcast appearances — not a deepfake, just a low-tech trick that proves highly effective. When apparent audio problems arise, the fake "interviewer" asks the target to download a patch — and that patch is the actual malware payload.

"They've stolen over $300 million via this method already," Monahan wrote in December, adding that "DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets." Kaspersky researchers have also documented cases where operatives recorded victims' own webcam footage during an initial compromise, then reused that footage to help deceive the next target in line.

05Malware that waits you out

The evasion mindset extends into malware design itself. LummaC2, one of the most widespread infostealers of 2025, now applies basic trigonometry to judge whether it's running inside a monitored sandbox. It records five mouse-cursor positions, computes the Euclidean vectors between them, and measures the resulting angles — on the theory that human movement tends to curve while automated sandbox tools move in straight lines. If any measured angle exceeds 45 degrees, the malware treats the environment as suspicious, resets its detection routine, and simply waits — operating on the principle that inaction is often the safest way to avoid analysis.

Bitdefender's review of 700,000 security incidents found that 84% of high-severity attacks relied on living-off-the-land techniques — using a target's own legitimate tools in ways that generate no alerts and mimic ordinary administrative activity.

Under the older threat model, ransomware at least offered a clear signal: a locked screen confirmed a breach had occurred. Digital parasites offer no equivalent clarity. They seek credentials, access, and trust, aiming to become functionally indistinguishable from normal operations. Volt Typhoon sat inside power-grid networks for roughly five years; DPRK-linked hires draw salaries for months before pivoting to extortion; and Lazarus Group spent seventeen days inside Safe{Wallet}'s infrastructure before extracting $1.5 billion in the Bybit hack. None of these intrusions needed to be loud — only patient.

Detection has genuinely improved for noisier attacks: median ransomware dwell time has fallen to roughly seven days. But state-sponsored campaigns operate on a different clock entirely — Volt Typhoon's dwell time was measured in years, not days. The parasite approach succeeds precisely because it stays quieter than any alarm system built to catch it.

06Where the industry's defenses fall short

The crypto industry has spent roughly a decade refining smart contract security — formal verification methods, bug bounty programs with seven-figure payouts, and increasingly sophisticated detection of reentrancy bugs and flash-loan attack vectors. Meanwhile, DPRK-linked operatives have continued walking in through the front door with a convincing resume and a fabricated work history.

By the end of 2025, $6.75 billion had been stolen through methods that bypassed code exploits entirely — compromised developers, stolen credentials, patient social engineering, and remote hires who cleared every technical interview. Seventy-six percent of all crypto service compromises in 2025 have been traced back to North Korean operations.

In effect, the industry has fortified the vault while leaving the person holding the keys unvetted. Somewhere, right now, a developer at a company adjacent to a protocol you rely on may have already opened a malicious file; a contractor with an immaculate GitHub history may already be sitting inside a team's private Slack; an employee several vendors removed may be quietly wondering why their AWS session tokens have stopped behaving normally. The clock on some of these intrusions may have already been running for weeks, unnoticed.

Trustless systems were the industry's great preoccupation — yet humans still build and operate them. Code routinely undergoes multiple audits; the people writing it typically get little more than a LinkedIn check and a technical interview. These intrusions don't require breaking any code — they only require organizations to keep hiring, trusting, and extending access without confirming who, or what, is actually on the other end.