Episode Details

This story was originally published on HackerNoon at: https://hackernoon.com/smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake-defi-startup.
Researchers infiltrated a fake DeFi startup to expose Famous Chollima's DPRK IT worker tactics, tools, infrastructure, and insider-threat risks.
Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #any.run-threat-intelligence, #dprk-insider-threat, #famous-chollima-investigation, #dprk-it-workers, #it-worker-infiltration, #north-korean-cyber-threat, #north-korean-it-worker-scheme, #good-company, and more.

This story was written by: @anyrun. Learn more about this writer by checking @anyrun's about page, and for more stories, please visit hackernoon.com.

Researchers from BCA LTD, NorthScan, and ANY.RUN created a fake DeFi startup to investigate how suspected Famous Chollima operatives infiltrate Western companies. The operation followed three suspected DPRK IT workers from recruitment and interviews through onboarding, remote development, tool usage, and access to company systems. The investigation exposed forged identities, mule accounts, remote-access tools, VPN infrastructure, AI-assisted workflows, and proxy servers, highlighting why DPRK IT worker schemes represent a persistent insider threat rather than a conventional cyberattack.