🚨 Infiltrators on the payroll: fake North Korean IT workers are a growing risk for Spanish organizations.
DPRK operatives may secure remote jobs using false or stolen identities, then funnel earnings to state-linked programs. Generative AI, remote work, and subcontracting increase the exposure.
ISDO examines the risk to Spain: no publicly confirmed cases yet, but the scenario is plausible and high-impact. The response requires coordination across HR, Security, Compliance, Legal, and Procurement: verify identities, control payments, restrict access, and share indicators across sectors.
📄 Full report: https://t.co/O4JIvzCsCi
#Cybersecurity #Intelligence #CorporateSecurity #Spain #DPRK #RiskManagement #NIS2 #Counterintelligence #ISDOisdo
October has been a busy month for ISDO. We took part in meetings and activities surrounding the 63rd Session of the Human Rights Council in Geneva, served as judges at international conventions, and joined the Annual Conference of the Political Studies Association of Ireland (PSAI).
Our research output continued without pause: three reports and manuals were published, and we finalized agreements and established relationships with new partners.
All publications: https://t.co/bG2yTJ2LGK
#ISDO #Research #HRC63 #PSAI
October has been a busy month for ISDO. We took part in meetings and activities surrounding the 63rd Session of the Human Rights Council in Geneva, served as judges at international conventions, and joined the Annual Conference of the Political Studies Association of Ireland (PSAI).
Our research output continued without pause: three reports and manuals were published, and we finalized agreements and established relationships with new partners.
All publications: https://t.co/bG2yTJ2LGK
#ISDO #Research #HRC63 #PSAI
How often are “false flag” claims actually proven? Less often than the debate suggests.
In our new manual, @Alvarito_RA96 and @SsainzISDO tested 38 recent incidents against three attribution criteria: technical traceability, multi-source convergence and evidence of intent. Under the strictest scoring, only one met all three. Six met at least two.
We also looked at 15 “false flag” claims from four narrative groups. Eight have been refuted by an institution, court or inquiry. Seven remain alleged.
Neither set is a representative sample. Both show how much the evidence threshold shapes the conclusion. That is the manual’s core argument: an incident, its attribution and a false-flag finding are three separate claims, and each needs its own evidence.
The manual also includes an attribution assessment procedure, a source-verification log and a 24 h / 72 h / 30 d verification framework. We have not yet tested the framework in live incidents.
Full manual (open access): https://t.co/s7wYKf9yEV
DOI: 10.5281/zenodo.23592176
#HybridWarfare #Attribution #OSINT #Security #Disinformation
The cost of not knowing
Deniable operations are designed to delay attribution, and delay has a price. ISDO’s manual on false-flag operations and hybrid warfare examines how uncertainty and the political cost of publicly naming an actor can paralyze a response. Its answer is not faster accusations, but shared terminology, measurable outcome indicators and systematic evaluation of the countermeasures already in use.
🔗 https://t.co/s7wYKf9yEV
#HybridWarfare #Attribution #Security
The cost of not knowing
Deniable operations are designed to delay attribution, and delay has a price. ISDO’s manual on false-flag operations and hybrid warfare examines how uncertainty and the political cost of publicly naming an actor can paralyze a response. Its answer is not faster accusations, but shared terminology, measurable outcome indicators and systematic evaluation of the countermeasures already in use.
🔗 https://t.co/s7wYKf9yEV
#HybridWarfare #Attribution #Security
How often are “false flag” claims actually proven? Less often than the debate suggests.
In our new manual, @Alvarito_RA96 and @SsainzISDO tested 38 recent incidents against three attribution criteria: technical traceability, multi-source convergence and evidence of intent. Under the strictest scoring, only one met all three. Six met at least two.
We also looked at 15 “false flag” claims from four narrative groups. Eight have been refuted by an institution, court or inquiry. Seven remain alleged.
Neither set is a representative sample. Both show how much the evidence threshold shapes the conclusion. That is the manual’s core argument: an incident, its attribution and a false-flag finding are three separate claims, and each needs its own evidence.
The manual also includes an attribution assessment procedure, a source-verification log and a 24 h / 72 h / 30 d verification framework. We have not yet tested the framework in live incidents.
Full manual (open access): https://t.co/s7wYKf9yEV
DOI: 10.5281/zenodo.23592176
#HybridWarfare #Attribution #OSINT #Security #Disinformation
How do we know who is behind a covert operation?
ISDO’s new manual on false-flag operations and hybrid warfare examines the limits of strategic attribution, the levels of evidence, and the gap between a plausible suspicion and a substantiated conclusion.
Every claim is tested against three criteria: technical traceability, multi-source convergence and evidence of intent. Of 38 contemporary incidents assessed, only one meets all three under the strictest scoring.
Analytical confidence is not political certainty.
https://t.co/s7wYKf9yEV
#HybridWarfare #Attribution #IntelligenceAnalysis
How do we know who is behind a covert operation?
ISDO’s new manual on false-flag operations and hybrid warfare examines the limits of strategic attribution, the levels of evidence, and the gap between a plausible suspicion and a substantiated conclusion.
Every claim is tested against three criteria: technical traceability, multi-source convergence and evidence of intent. Of 38 contemporary incidents assessed, only one meets all three under the strictest scoring.
Analytical confidence is not political certainty.
https://t.co/s7wYKf9yEV
#HybridWarfare #Attribution #IntelligenceAnalysis
By far, our Security and Intelligence Department is our most prolific division and the one that has published the most so far in 2026.
With a particular focus on document forgery, geopolitics, and risk prevention, this department will continue to be a major topic of discussion in the future.
Access all publications: https://t.co/G7f9XUjAcQ
#Geopolitics #Security #Intelligence
By far, our Security and Intelligence Department is our most prolific division and the one that has published the most so far in 2026.
With a particular focus on document forgery, geopolitics, and risk prevention, this department will continue to be a major topic of discussion in the future.
Access all publications: https://t.co/G7f9XUjAcQ
#Geopolitics #Security #Intelligence
ISDO Security Alert:
Our Security and Intelligence Department has issued an alert regarding attempted fraudulent transactions involving the purchase of vehicles valued at over €30,000.
The transactions were halted after our staff verified that false documentation had been used. The matter has been formally reported to the relevant European authorities.
We advise all parties to remain vigilant and to verify the authenticity of any documentation before proceeding with high-value transactions.
#ISDO #SecurityAlert #FraudPrevention #VehicleFraud #DocumentVerification #EuropeanAuthorities #DueDiligence #ConsumerProtection
Your next security breach may arrive through the hiring process.
North Korean IT workers apply for remote jobs under false or stolen identities, do real work, and send their salaries to fund the regime’s weapons programs. Generative AI has erased the old warning signs: perfect résumés, fluent English, even deepfake video in interviews.
ISDO’s new report shows why this is no longer just a cybersecurity problem. The useful signals sit in different departments: selection, access, payroll, procurement. No single team sees the full pattern.
One of the cheapest controls: pay only an account held by the person or entity you contracted.
Is your hiring process built to verify identity, or only to assess skills?
Full report: https://t.co/O4JIvzCsCi
#HumanResources #InsiderThreat #Cybersecurity #RemoteWork
When data makes the difference.
ISDO Strategic Advisory helps governments, NGOs, multilateral organizations, and companies turn complex economic, security, sustainability, and geopolitical risks into decisions they can act on.
From market shocks to ESG strategy and geopolitical intelligence, we deliver rigorous, evidence-based analysis—not just reports.
Explore our four areas of practice 👇
https://t.co/FUIwsBCaWO
#StrategicAdvisory #GeopoliticalRisk #SustainableDevelopment #ESG #Security #DataDriven
ISDO Security Alert:
Our Security and Intelligence Department has issued an alert regarding attempted fraudulent transactions involving the purchase of vehicles valued at over €30,000.
The transactions were halted after our staff verified that false documentation had been used. The matter has been formally reported to the relevant European authorities.
We advise all parties to remain vigilant and to verify the authenticity of any documentation before proceeding with high-value transactions.
#ISDO #SecurityAlert #FraudPrevention #VehicleFraud #DocumentVerification #EuropeanAuthorities #DueDiligence #ConsumerProtection
When data makes the difference.
ISDO Strategic Advisory helps governments, NGOs, multilateral organizations, and companies turn complex economic, security, sustainability, and geopolitical risks into decisions they can act on.
From market shocks to ESG strategy and geopolitical intelligence, we deliver rigorous, evidence-based analysis—not just reports.
Explore our four areas of practice 👇
https://t.co/FUIwsBCaWO
#StrategicAdvisory #GeopoliticalRisk #SustainableDevelopment #ESG #Security #DataDriven
A fake North Korean IT worker has to get through five phases: build an identity, get recruited, get onboarded, exploit access, and get paid. ISDO’s new report makes the defender’s advantage clear: the operative must clear every phase, while the organization needs to break only one. Payment is among the cheapest to control: pay only an account held by the person or entity you contracted.
🔗 Full report: https://t.co/O4JIvzCsCi
#Cybersecurity #InsiderThreat #NorthKorea
A fake North Korean IT worker has to get through five phases: build an identity, get recruited, get onboarded, exploit access, and get paid. ISDO’s new report makes the defender’s advantage clear: the operative must clear every phase, while the organization needs to break only one. Payment is among the cheapest to control: pay only an account held by the person or entity you contracted.
🔗 Full report: https://t.co/O4JIvzCsCi
#Cybersecurity #InsiderThreat #NorthKorea