Researchers Pose as Fake Crypto Startup to Hire Suspected North Korean IT Workers

Security researchers created a fictitious cryptocurrency startup and hired three individuals they believe were North Korean IT operatives, as part of an undercover operation to expose hiring fraud and cyber espionage tactics. The operation, a sequel to a December 2025 engagement, was conducted by threat intelligence firm BCA LTD, the NorthScan research initiative, and sandbox provider ANY.RUN. The team built a fake DeFi protocol called Ballena Azul and advertised developer jobs.

The three hires submitted fraudulent documentation, including driver’s licenses and bank accounts that did not match their claimed locations. One hire’s image metadata revealed processing by Google Gemini and a SynthID watermark, indicating AI-generated or edited content. Another provided a genuine iPhone photo with GPS coordinates stripped. The researchers observed that all three operatives conducted reconnaissance on day one, running system profiling commands and checking their apparent geolocation. One operative installed Chrome Remote Desktop and synced personal accounts, exposing browsing history and saved passwords.

The operation highlighted the use of tools such as 2fa.cn for two-factor code passing, AstrillVPN for anonymization, and AI job-application extensions like AIApply and Final Round AI. The researchers presented their findings at DEF CON 34 and attributed the operatives to the Famous Chollima group, which CrowdStrike associates with North Korea’s IT worker operation under the Lazarus umbrella. The joint government alert from July 31 warns of North Korean IT workers seeking contracts to remit salaries to Pyongyang and advises employers to conduct periodic identity checks and block AstrillVPN.