A Fake DeFi Startup Exposed How North Korean IT Workers Get Hired
Researchers built a shell company, ran a full hiring pipeline, and let sandboxed 'employees' walk straight into a monitored environment — capturing the tooling behind DPRK employment fraud in granular detail.
Key Takeaways
- Researchers from BCA LTD, NorthScan, and ANY.RUN built a fake DeFi company, 'Ballena Azul LTD,' and ran a real hiring process to observe DPRK-linked IT worker fraud from the inside.
- Sandboxed 'new hires' were recorded using AI tools (ChatGPT, Google Gemini) to forge IDs, live-translate interviews, and write code — while routing through AstrillVPN and DPRK-operated infrastructure.
- The investigation logged 12 IPv4 addresses tied to DPRK VPS/VPN infrastructure and three cryptocurrency wallets, and was presented publicly at DEF CON 2026.
- The case is a reminder that employment fraud runs in both directions: fake employers scam job seekers, but fraudulent employees can also scam employers — and standard remote-hiring checks miss both.
Most "employment scam" coverage focuses on fake job postings that con applicants out of money or data. A research collaboration written up by Schneier on Security inverts that framing: it studies fraud running the other way, where the *applicant* is the threat actor and the *company* is the target.
The honeypot: a fake DeFi company as bait
Researchers Mauro Eldritch (BCA LTD) and Heiner García (NorthScan), working with the ANY.RUN sandboxing platform, built Ballena Azul LTD — a fictitious DeFi company complete with a working website, an OpenSea NFT presence, a UK company registration used for credibility, and fabricated founders. The goal was to attract and hire remote developers through the same channels DPRK-linked IT worker operations are known to use, then watch what happened once those hires had access to company systems.
According to the writeup published by ANY.RUN, the operation is a follow-up to an earlier engagement from December, and this second round hired several operatives — including individuals the researchers link to the Famous Chollima cluster — after outreach through GitHub.
What the sandbox recorded
Because the hires worked inside monitored ANY.RUN environments, the researchers captured file activity, network connections, and — via QR-code canary tokens during video calls — live footage of the people on the other end. The recorded tradecraft included:
- AI-forged identity documents — fake driver's licenses generated with Google Gemini, including cases where Gemini's SynthID watermark was still embedded, plus at least one stolen photo of an unrelated person's real ID.
- Live interview assistance — operatives reading translated answers off a second monitor during video interviews.
- Routine AI-assisted coding — heavy day-to-day use of ChatGPT to complete the actual job tasks assigned.
- Infrastructure fingerprints — AstrillVPN exit nodes, AnyDesk and Google Remote Desktop sessions, and 2FA codes relayed through 2fa.cn, all tied back to DPRK-operated VPS providers.
- Financial setup — fraudulent accounts opened at real banks (including Lead Bank and Citibank) and payment routed through wallets on MetaMask and Bitget.
The team says it logged 12 IPv4 addresses attributable to DPRK infrastructure and three cryptocurrency wallets, and presented the findings at DEF CON 2026 following an earlier InsomniHack talk.
Why this matters beyond one case study
This isn't a novel threat — DPRK IT worker infiltration of remote engineering roles has been documented by the FBI and multiple vendors for several years. What's new here is the resolution: instead of a retrospective incident writeup, this is a controlled, instrumented view of the entire lifecycle — application, interview, onboarding, and day-to-day work — with the operator's own tooling captured on camera. That level of detail is unusually actionable for anyone building or auditing a remote-hiring pipeline, because it shows exactly which control points (identity verification, interview format, device provisioning, access review) the tradecraft is built to slip past.
What this means for hiring and vendor pipelines
The practical lesson for security teams isn't "watch out for North Korea" in the abstract — it's that identity verification and interview processes designed for good-faith candidates aren't built to catch someone using AI tooling to fabricate documents and translate answers in real time. Live-video identity checks, device attestation on company-issued hardware, and treating a new remote hire's first weeks of access like any other unverified third party are cheap, concrete mitigations against exactly the tradecraft this research documented.
Frequently Asked Questions
What is 'employment scam' research in this context?
It refers to studying fraud in remote hiring from the employer's side — researchers built a fake company and hired people through normal channels to observe how DPRK-linked IT worker operatives pass interviews and onboarding, rather than studying scams against job applicants.
What tools did the fake hires actually use?
The ANY.RUN writeup documents AI tools (ChatGPT and Google Gemini) used for coding and for forging identity documents, AstrillVPN for connectivity, AnyDesk and Google Remote Desktop for remote access, and real bank and crypto-wallet accounts opened under fraudulent identities.
Is this the same activity the FBI has warned about?
The pattern — DPRK-linked individuals obtaining remote IT jobs at Western companies under false identities — matches infiltration schemes that US authorities and multiple threat-intel vendors have described previously; this research adds a closely instrumented, first-hand view of the tooling and workflow involved.
Sources
- 1Researching Employment Scams — Schneier on Security
- 2Smile, You're on Camera! Part 2 — Lazarus Group IT Workers Investigation — ANY.RUN
- 3Lazarus Group IT Workers Investigation (Part One) — ANY.RUN