Splunk Releases Guide to Detect Remote Employment Fraud Within Your Organization

Detecting remote employment fraud has become a critical priority for organizations striving to secure their digital onboarding processes and safeguard sensitive systems.

In recent months, threat actors posing as legitimate hires have leveraged sophisticated tactics to bypass pre-hire screenings and embed themselves within corporate networks.

This emerging threat vector, known as Remote Employment Fraud (REF), exploits gaps between human resources workflows and security monitoring, allowing malicious insiders to gain persistent access and exfiltrate data under the cover of a legitimate employee identity.

The initial stages of REF involve threat actors meticulously crafting resumes, passing background checks, and scheduling interviews that appear indistinguishable from genuine candidates.

Once onboarded, they request shipment of corporate assets—laptops, mobile devices, or network tokens—to addresses that often diverge from their purported locations.

Through careful correlation of asset management logs with applicant tracking data, organizations can reveal discrepancies that point to fraudulent activity.

Splunk analysts identified the first wave of these anomalies by matching ServiceNow shipment records against Workday employee profiles, flagging cases where the delivered location did not align with an employee’s registered home state.

Splunk analysts noted that REF actors frequently leverage nonstandard VPN services to obfuscate their true IP addresses and geolocations.

While virtual private networks are commonplace for legitimate remote work, inconsistencies between expected corporate VPN endpoints and unusual third-party VPN providers serve as strong indicators of fraud.

By creating baselines in Identity Provider (IdP) logs—such as Okta or Duo—security teams can detect anomalous VPN sessions and enforce network zones that block unauthorized anonymizer services.

Beyond transport-layer evasion, REF actors may employ improbable travel tactics to mask their origin.

Login attempts from geographically distant locations within implausible timeframes—such as a login from London minutes after a session in New York—underscore the need for geospatial analytics.

Splunk Enterprise Security’s Authentication Data Model can calculate approximate travel speed between login events to surface these anomalies, enabling rapid investigation before a breach escalates.

Infection Mechanism and Persistence Through Asset Misshipment

An in-depth look at the most prevalent REF infection mechanism reveals how initial device shipment inconsistencies provide the foothold for continued access.

Threat actors request corporate laptops to be sent to alternate locations, often invoking urgent personal circumstances to justify mismatches.

Once the device arrives, embedded persistence tactics—such as installing unsanctioned remote access tools—ensure ongoing connectivity.

Security teams can prevent these operations by correlating applicant tracking system (ATS) data with IT asset logs in Splunk.

index=servicenow sourcetype=laptop_shipment
| eval delivered_location=case(arrivalState="CA","California", arrivalState="TX","Texas")
| join type=outer Email [search index=identity sourcetype=workday_employee]
| eval Suspicious=if(delivered_location!=home_state,"Yes","No")
| search Suspicious="Yes"
| table name, employeeId, home_state, delivered_location, Email

By automating this detection query, organizations can immediately surface potential REF cases, prompting joint investigations by security and HR teams.

Integrating these detections into a Risk-Based Alerting (RBA) framework further enhances visibility, enabling prioritized incident response workflows that minimize false positives and drive efficient mitigation.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.