A North Korea-linked hiring operation appears to have exposed its working methods after cybersecurity researchers created a fake DeFi company, recruited three suspected operatives, and watched them work inside instrumented virtual desktops.
The operation, conducted by ANY.RUN with BCA LTD and the NorthScan threat-intelligence initiative, targeted a hiring cell associated with Lazarus Group’s “Famous Chollima” unit. Researchers said they posed as the leadership team of Ballena Azul LTD, a fictional decentralized-finance protocol, and used the company’s hiring process to place applicants in a monitored environment.
The setup gave the researchers an unusually detailed view of how the workers assessed corporate machines, established remote access, used AI services, and handled identity documents. Rather than attempting a quick technical breach, the suspected operatives appeared to be seeking paid roles that could gradually provide access to internal code repositories, business processes, credentials, and cryptocurrency infrastructure.
That approach places hiring teams alongside security engineers in the first line of defense. A remote developer who receives legitimate access to repositories, cloud services, wallets, or deployment systems can create exposure without relying on a conventional exploit.
Three developers entered the controlled environment
The researchers hired three applicants using the names Angelo Espree, Jack Anderson, and Lucas Theo. They were assigned smart-contract, front-end, and back-end development work, covering functions that could collectively expose a DeFi project’s codebase and operational systems.
As part of staged onboarding, the applicants supplied personal identity and payment materials. According to the ANY.RUN, BCA LTD, and NorthScan report, Anderson provided a Texas driver’s license, a Social Security number described by the researchers as valid, and banking details for Lead Bank in Kansas City.
Espree claimed to be based in Pasadena, Texas, but submitted a California driver’s license along with a Citibank account in New York, the report said. Researchers found that EXIF metadata associated with the identity image indicated processing through Google Gemini and included a SynthID watermark, a marker used by Google for some AI-generated or AI-edited content.
Theo supplied a New York driver’s license under the name Pui Chin Teoh and a Wise account, according to the researchers. The image metadata indicated that the underlying photograph had been taken on an iPhone 15, while GPS information had been removed.
The cases illustrate a practical hiring problem for crypto companies: documents, payroll information, professional profiles, and technical test results may each look plausible in isolation. Conflicting locations, unusual image metadata, and payment details spanning multiple jurisdictions can become more useful when reviewed together than when handled as routine administrative paperwork.
Remote-access tools followed early reconnaissance
After receiving access to the virtual desktops, the workers began with standard Windows reconnaissance commands, including dxdiag, systeminfo, and wmic, the report said. They also visited ip8.com, a service used to check an internet connection’s apparent location and network details.
The operatives then installed remote-access tools, including Google Remote Desktop, and connected through AstrillVPN exit nodes, according to the researchers. Remote desktop software can be legitimate in a distributed workplace, but within the controlled operation it gave the researchers visibility into how the group intended to maintain access from elsewhere.
One early mistake apparently revealed additional information. The report said an operative enabled Google account synchronization on a controlled machine, a feature that can transfer browser history, saved passwords, extensions, and other account-linked data to a signed-in device. The workers later logged into GitHub and continued software-development tasks inside the monitored environment.
The researchers described their environment as capable of recording opened files, network connections, and many on-screen actions over sessions lasting several hours. That level of telemetry allowed them to observe technical behavior that would be difficult to infer from a résumé, video interview, or code submission.
AI tools were embedded in the workflow
The three workers made extensive use of ChatGPT and Google Gemini for coding, translation, and document-related tasks, the report said. Their browser extensions included Saved Prompts for GPT, Simplify Copilot, AIApply, and Final Round AI.
Researchers also observed Cursor, Visual Studio Code, and Remix, a browser-based Ethereum development environment. The wallet software seen in the environment included MetaMask and Bitget Wallet. Other services and tools listed in the report included AnyDesk, Outlook.com, 2fa.cn, Vultr, and Gorilla Servers.
The observed activity suggested that AI tools were serving as a practical productivity layer rather than an occasional reference source. Researchers said the workers searched for basic material on subjects such as upgradeable smart contracts and encountered difficulty obtaining testnet tokens before continuing work with what the report called fictional assets.
Those apparent skill gaps do not eliminate the risk posed by a fraudulent hire. A worker with access to proprietary code, internal chat, development credentials, or deployment processes may be able to collect intelligence or create opportunities for other operators, even without being the strongest engineer on a team.
Controlled disruptions exposed supporting infrastructure
The researchers introduced simulated technical problems, including intermittent network outages, disappearing cursors, and repeated CAPTCHA prompts. They then offered in-environment IT support, a tactic designed to encourage the workers to reveal how they connected to and troubleshot their systems.
According to the report, the disruptions generated additional traces tied to proxy and jump-server infrastructure used to reach the virtual desktops. A jump server is an intermediary machine used to access another network or system, often separating a user’s device from the final target.
The report also noted changes from an earlier encounter with the group. Researchers said they did not observe authenticator.cc or otp.ee, services previously associated with the operation, while 2fa.cn appeared in the newer activity for sharing two-factor authentication codes.
The engagement ended after the researchers staged a confrontation involving a supposed venture-capital contact. The report identified the purported representative, Aelin Ashriver of Definitive Communications, as Korean reporter Yohan Yun. After an in-character exchange led by the operation’s Benito persona, Espree and Anderson stopped communicating and the group disengaged, researchers said.
Hiring access can become a long-term intrusion route
Lazarus-linked activity has repeatedly been connected to major cryptocurrency thefts, including the $620 million Ronin Network bridge attack and the $100 million Harmony Horizon Bridge theft. The research team also cited other cases attributed in public reporting to North Korea-linked actors, including the $1.5 billion Bybit theft, the DMM Bitcoin-related incident, and the Atomic Wallet attack.
The Ballena Azul operation focuses on an earlier stage of the threat cycle: obtaining a trusted role before any theft or sabotage is attempted. Salaries, access permissions, company accounts, and collaborative development tools can become part of the intrusion mechanism when the employee’s identity and allegiance are fraudulent.
For DeFi teams, screening cannot stop at checking whether an applicant can complete a coding task. Access should be segmented by role, development environments should be separated from production systems, and wallet or deployment permissions should not be concentrated in a newly hired contractor’s account. Identity checks also need to account for AI-altered documents and mismatched location, banking, and device signals.
The researchers’ operation shows how a controlled hiring process can expose behavior that conventional interviews miss: reconnaissance commands, remote-access setup, VPN routing, account synchronization, and the use of external systems to support day-to-day work. In a sector where a small group of developers can influence smart contracts and treasury controls, the line between recruitment and security monitoring has become increasingly thin.
Want to protect your crypto from similar threats? Learn essential safeguards in crypto safety standards now.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
