Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.
Researchers from BCA LTD, NorthScan and ANY.RUN built a fake DeFi protocol called Ballena Azul and hired three suspected Famous Chollima operatives through a real recruiting pipeline. The hires submitted inconsistent or AI-processed identity documents, including a driver's license whose metadata showed Google Gemini processing and a SynthID watermark. On day one the workers profiled their assigned VMs, checked their egress country, and one installed Chrome Remote Desktop and logged into GitHub. The findings were presented at DEF CON 34 and align with a July 31 joint government alert on DPRK IT worker schemes.
- Fake DeFi startup 'Ballena Azul' recruited developers via facilitators found on GitHub
- Documents showed Gemini metadata and a SynthID watermark; one license belonged to another person
- Day-one behavior: system profiling, egress checks, Chrome Remote Desktop install, GitHub login
- Infrastructure used AstrillVPN exit nodes and 2fa.cn for 2FA relay; AI interview-assistance extensions observed
- Earlier DOJ case placed DPRK workers at 100+ US companies on 80+ stolen identities for $5M
- Products
- Chrome Remote DesktopAstrillVPN
- Threat actors
- Famous ChollimaLazarus Group
- Organizations
- CrowdStrikeDEF CON
- Countries
- North Korea
- AI models
- Google Gemini
From the original article
3 min read at thehackernews.com
Swati Khandelwal Aug 11, 2026 Insider Threat / Cyber Espionage Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.