Verizon security researchers immediately found that VPN connections from Shenyang had been occurring almost daily for some six month, and sometimes spanned an entire work day.
Investigators then turned their attention to the computer of the developer, who is described as well versed in multiple languages including C, C++, Ruby, php and Java.
The developer, said to be in his mid-40s, was a long-time employee, a family man, inoffensive and quiet. "Someone you wouldn't look at twice in an elevator," Valentine noted in his blog.
Investigators probed the developer's computer for malware and other clues, but instead turned up hundreds of pdf invoices from a Chinese consulting firm.
From, there, investigators quickly pieced together what happened.
"As it turns out, Bob had simply outsourced his own job to a Chinese consulting firm. Bob spent less that one fifth of his six-figure salary for a Chinese firm to do his job for him," Valentine said.
He had FedExd his RSA token to the Chinese firm so that the company could log in and work using his credentials. Meanwhile "Bob" was typically in his office at the company from 9 a.m. to 4:30 p.m. watching cat videos, reading stories on Reddit and spending time on eBay, Facebook and LinkedIn, the blog post said.
At 4:30 p.m. most days, he would send an end of day update to his managers.
"Evidence even suggested he had the same scam going across multiple companies in the area. All told, it looked like he earned several hundred thousand dollars a year, and only had to pay the Chinese consulting firm about fifty grand annually," the blog post said.
Bob's superior's had rated his work as excellent quarter after quarter.
"His code was clean, well written, and submitted in a timely fashion. Quarter after quarter, his performance review noted him as the best developer in the building," Valentine wrote in his blog.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about security in Computerworld's Security Topic Center.