Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD, a company dedicated to threat intelligence and hunting, Heiner García from NorthScan, a threat intelligence initiative uncovering North Korean IT worker infiltration, andANY.RUN, the leading company in malware analysis and threat intelligence.

The article was written by Mauro and Heiner.

Key Takeaways

• Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives, providing a rare inside view of a DPRK IT worker operation.
• The investigation followed the scheme beyond recruitment, showing how the operatives worked, collaborated, and accessed company resources after being hired.
• ANY.RUN sandbox environments provided a live view of the operatives’ behavior, exposing their evolving toolset, remote access workflow, AI usage, and supporting infrastructure.
• The findings show that DPRK IT worker schemes are not only a hiring risk. Once inside, operatives can gain legitimate access to...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE