North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees
Brief
A joint undercover investigation has pulled back the curtain on how North Korean IT worker operatives don’t just slip past hiring checks; they settle in, gain trusted access, and quietly work from inside legitimate companies for months at a time.
The research, conducted by threat intelligence specialists Mauro Eldritch (BCA LTD) and Heiner García (NorthScan), in partnership with malware analysis firm ANY.RUN , followed up on an earlier operation documenting recruitment cycles used by Famous Chollima, a group tied to the broader Lazarus ecosystem.
Rather than stopping at the recruitment phase, researchers set up a complete honey-company: a decentralized finance (DeFi) startup called Ballena Azul LTD, equipped with a professional website, branding, and a plausible blockchain pitch.