On July 15, the company flagged malware loaded onto an Apple laptop sent to the remote worker. Simultaneously, the AI-filtered photo used by the imposter was identified by the company's Endpoint Detection and Response software. Quick action by the SOC team led to the containment of the fake worker's systems after they ceased responding to outreach. During a brief 25-minute window, the attacker engaged in various malicious activities, including manipulating session history files, transferring potentially harmful files, and executing unauthorized software. Sjouwerman noted that the attacker utilized a single-board computer Raspberry Pi to download the malware. Following the incident, KnowBe4 shared its findings with the FBI and Mandiant, a Google-owned cyber firm. Their collaborative investigation concluded that the worker was a fictional persona operating from North Korea.