Researchers Trap 3 Suspected North Korean IT Workers With Fake Startup
Updated
Updated · PCMag · Aug 13
Researchers Trap 3 Suspected North Korean IT Workers With Fake Startup
3 articles · Updated · PCMag · Aug 13
Summary
Three suspected North Korean IT workers were hired by a fake crypto startup set up by researchers, who recorded their interviews, work sessions and final confrontation before two abruptly quit a video call.
Ballena Azul, posing as a decentralized-finance company, drew applicants through a GitHub recruiter; the hires claimed to be in the US and submitted driver’s licenses and Social Security numbers that appeared forged or stolen.
Any.Run monitoring on a virtual desktop showed the workers masking their location with AstrillVPN and leaning heavily on ChatGPT, with saved prompts spread across browser extensions.
The researchers said the trio also struggled with basic coding tasks, undercutting their claimed expertise and exposing how fraudulent remote hires can still penetrate companies.
DEF CON hosted the presentation last week, adding fresh detail to a long-running threat that the FBI said last month had already reached a federal government agency.