A Fake DeFi Startup Hired 3 Suspected North Korean Developers: What Happened Next?
Threat intelligence researchers built a fake Decentralized Finance (DeFi) startup, hired suspected North Korean IT workers as developers, and watched them from the inside.
The operation reversed the usual infiltration playbook. Instead of catching operatives trying to break in, researchers watched them work after they cleared interviews.
How the Fake Startup Exposed North Korean IT Workers
The investigation was a joint effort by BCA LTD's Mauro Eldritch, NorthScan's Heiner García, and ANY.RUN. Researchers registered Ballena Azul LTD as a protocol serving cryptocurrency whales.
They gave it a website, corporate branding, and a matching UK company registration to look legitimate. They then posed as founders and a team lead.
The researchers used the ANY.RUN sandbox platform as the work environment. It recorded every move of the operatives. Angelo Cruz, a recruiter the team met on GitHub, supplied the first developer.
That hire recommended a second, who brought in a third. All three cleared interviews and received access to virtual desktops that were actually controlled recording environments.
โฆ Continue reading the full article at the original source below.
