Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker
Source: security company ANY.RUN
Compiled by Daily Planet Daily
Original title: Fishing Show of the Year, Fake DeFi Traps Out Real Hackers from North Korea's Lazarus
Real Madrid fans, math background, only use AI to write code.
Core ideas:
By setting up fake DeFi companies, security agencies
Successfully infiltrated the “Famous Chollima” hacker group under North Korea's Lazarus Group,
It revealed its complete process of using false identities, AI tools, and remote collaboration to infiltrate Western companies,
It also revealed its ever-evolving toolset and infrastructure.
Key elements:
The researchers disguised themselves as recruiters and recruited three North Korean agents within a few months.
The ANY.RUN sandbox environment records its operation behavior, tool usage, and collaboration mode in real time.
Agents use forged driver's licenses, stolen social security numbers, and mule accounts to complete the entry process.
Some of these documents have been processed by Google Gemini and have a SynthID watermark, revealing signs of forgery.
Attackers rely on AI tools such as ChatGPT and Google Gemini to encode, translate, and modify files.
It also uses AstrillVPN, remote desktop software, and dedicated servers to covertly access corporate environments.
The three agents showed insufficient skills during the development process and frequently searched for basic issues.
It also exposed more proxy server and infrastructure information due to selective network interruptions and captcha induction.
The investigation found that Famous Chollima aims to lurk within the company for a long time and legally obtain access to codes, systems, and intellectual property rights.
It's not limited to short-term attacks; the threat persists significantly.
Crypto friends who are often phished have probably heard of the North Korean hacker group Lazarus Group.
Its well-known “campaigns” include, but are not limited to: the Bybit ($1.5 billion) theft case,
Ronin Network/Axie Infinity bridge attack ($620 million), DMM Bitcoin/Ginco related attacks ($308 million),
Harmony Horizon Bridge attack ($100 million), Atomic Wallet attack ($100 million), etc.
And the key to the success of these attacks is inseparable from social engineering —Hackers usually disguise themselves as normal job applications.
A lurking crypto company that has been lurking for years, waiting for the right time.
Recently, the security agency ANY.RUN cooperated with BCA LTD (a company dedicated to threat intelligence and hunting)
and NorthScan (a threat intelligence program to uncover the infiltration of North Korean IT workers),
The three parties joined forces to effectively crack down on North Korean hacker agents.
Researchers have created a fake DeFi startup,
It also successfully recruited “Famous Chollima” agents under North Korea's Lazarus Group who specialize in human infiltration.
This gave me an inside perspective on the actions of IT workers in North Korea. The ANY.RUN sandbox environment shows the agent's behavior pattern in real time.
It revealed their evolving toolset, remote access workflows, use of AI tools, and the infrastructure that supports them.
This survey went beyond a simple recruitment process and showed in depth how these agents collaborated, obtained, and used company resources after joining the company.
Research findings suggest that North Korea's IT worker program poses more than a recruitment risk;
Once agents sneak inside an organization, they can legally gain access to code, systems, intellectual property, and critical business processes.
The following is a report co-authored by the three parties, compiled by the Daily Planet Daily.
——————————
introduction
Last December, we fully recorded the “Famous Chollima” infiltration cycle for the first time.
From recruiting accomplices to help them join Western companies, to falsifying documents and shipping laptops to middlemen's homes,
Even during interviews, AI tools are used to assist and translate in real time, keeping the whole process under control.
In that survey, we pretended to be a middleman willing to interview them and lend them a laptop in exchange for a percentage of their salary.
The point is that those laptops are actually ANY.RUN sandbox environments that record every click and every step they take.
This provides us with massive metrics, hours of computer operation video, and face-to-face contact video data.
It was an unprecedented investigation and made headlines in many media.
(“Famous Chollima” recruiter, codename Aaron of “Flame”)
It's no easy feat; it takes months of hard work to figure out their details while playing their partner in crime. And today, we decided to take it a step further.
This time, instead of pretending to be a middleman, we have transformed ourselves into the founders of Ballena Azul LTD.
It's a brand-new DeFi protocol company that works directly with cross-chain cryptocurrency giant whales and is looking for developers to build its platform.
They are developers we can trust huge sums of money — a huge amount, far more than the money you and all your friends have in your pocket, more than you can count commas.
Blue Whale Ltd Website
This new chapter has it all:A CEO who is overconfident and doesn't conduct background checks on employees;
Counterfeit developers with forged documents; mule accounts used for money laundering;
A journalist masquerading as a venture capitalist; and an Italian lawyer who ultimately detonated the world. Come on, the good play has begun!
Chapter 1: The Chollimas
First, let's take a quick look at our main opponents. Famous Chollima is one of many branches of the North Korean Lazarus organization.
Its goal is simple and straightforward:Employed by a Western company.
They target remote positions in industries where intelligence value and money are extremely high.
Cryptocurrency, finance, and healthcare have always been their go-to targets,
Recent action has extended to pharmaceuticals, civil engineering, construction, and other fields.
To get these positions, they rely on fake identities, fake resumes, proxy interviews, remote assistants, and ghost developers.
Everyone works together to convince the company that the person they are hiring is who they claim to be.
(North Korean agent caught by Bitso Quetzal's team during a company interview)
Unlike traditional invasions, their goal is not to take down an organization within hours or days, but to be part of it.
Successful onboarding provides months or even years of continuous access to internal systems, source code, intellectual property, and corporate decision-making processes.
At the same time, they can also earn legal wages, and eventually send money back to the North Korean regime.
This makes “Famous Chollima” a very different kind of threat.
Malware actions can have amazing results overnight, but these actions themselves are also very noisy and come with significant risk of exposure.
In contrast, employees are less at risk of exposure.
The longer they are trusted, the more opportunities they have to gather intelligence, influence decisions, and gradually integrate into the organization.
If enough agents get positions within the same company, they may eventually influence engineering decisions,
Code reviews, pull requests, approvals, or other trust-based processes without exploiting any software vulnerabilities.
Knowing that they are actively seeking such opportunities, we decided to take the initiative to create one for them.
Chapter II: The Company
The answer is Ballena Azul LTD.
On the face of it, this is the company “Famous Chollima” dreams of: a DeFi protocol partnering with cryptocurrency giant whales across multiple blockchains.
We are looking for experienced developers to help build the platform.
The agreement itself is simple. By combining NFTs and other on-chain mechanisms, Giant Whale wallets can voluntarily identify themselves and publicly declare ownership.
The idea is to reduce unnecessary market speculation when large amounts of capital flow,
Avoid rumors such as exchanges being hacked, wallets stolen, and withdrawal scams that cause fear in the ecosystem.
Ballena Azul LTD on the OpenSea NFT Marketplace
Everything has to look real and believable. A professional website, corporate brand, documentation, online presence, and most importantly, a product that makes sense.
We did this not because we expected investors to believe it, but because we expected them to (get hooked).
(Ballena Azul LTD registration information already available in the UK Companies Registry helps strengthen the legitimacy of the company. This entity has nothing to do with our actions)
I am Leonardo Nelson, co-founder of Ballena Azul LTD.
My business partner Benito will join our conference from Italy.
Meanwhile, Heiner is once again playing Andy Jones, the developer and facilitator in the first episode.
This time he was the technical director at Ballena Azul and was personally recommended to me by Benito.
In terms of infrastructure, we chose the most trustworthy provider: ANY.RUN. Now everything is ready, only the developers owe it.
Fortunately, Andy knows just the right person for this position:Angelo Cruz,
A foreign recruiter for “Famous Chollima” who wants to stand out.
Chapter 3: Horse Dealer
Angelo Cruz met Andy on GitHub.
They started chatting, and soon after, Cruz convinced Andy to collaborate.
Andy acted as his trusted helper to help his developers find jobs.
Angelo's comment on GitHub looking for facilitators
Andy agreed and soon introduced Angelo to Ballena Azul LTD (our company), calling it the perfect opportunity.
According to the plan, Ballena Azul LTD will be another lamb waiting to be slaughtered.
After all, we trust Andy's judgment, and we welcome whoever he chooses.
Interview with Famous Chollima (watch video on YouTube)
To create a false sense of trust, Andy offered to lend them his brother's ID, but in the end, they didn't use it.
Soon after, Angelo introduced us to our first engineer: Angelo Espree (the drama begins).
Chapter 4: Teams
Angelo Espree was the first to accept the position at Ballena Azul LTD.
He also became the first North Korean IT worker to join our company and the number one person in our investigation file.
Before the interview, Andy and Angelo agreed on a simple statement: they would tell the CEO (me)
Benito has met Angelo and personally vouched for him to join the company.
And so, our first interview began.
Angelo is a Real Madrid fan with a math background and will be responsible for developing the company's smart contracts.
Angelo's interview (Watch video on YouTube）
During the interview, we asked Angelo to scan a QR code to confirm attendance. He did the same and, of course, fell into the oldest trap.
The QR code quietly redirects him to one of our Canary Tokens, which records information such as the trigger's IP address and user agent.
At the time, this seemed like a minor mistake. But later, it became critical evidence to uncover a larger conspiracy.
We'll talk about that later. Right now, we're just happy to have made new friends.
As friends, we explained that Ballena Azul is an environment based entirely on trust, and we only intend to recruit people we can really trust.
Angelo already has someone in mind: his friend Jack Anderson (Belt and One, continues to recommend members of other hacking groups).
Jack is noticeably quieter and less fluent in English. Throughout the interview, we found him glancing off the screen several times.
It's like watching a real-time translation tool running on another monitor — this is also one of the standard tools for “Famous Chollima.”
Like Angelo, Jack also studied math and supported Real Madrid.Don't laugh.
Nevertheless, he convinced us and we welcomed him to Ballena Azul LTD as a front-end developer.
Things go hand in hand, and in this business, everyone needs someone they can trust.
Jack recommended Lucas Theo, a veteran backend developer. We interviewed him.
He understood the job requirements, showed a keen interest in the position, and even talked to us about his dog Lulú,
Honeymooners in the Philippines and a love for hiking. We have no reason to doubt him.
So we also welcome him to the Ballena Azul family.
Lucas's interview (watch video on YouTube)
At this point, they have formed the perfect team to carry out the shocking heist.On our side, we have a house full of “Chirima” waiting to be tamed.
But you know, any clever lie requires documentation — lots of documentation.
Chapter 5: Imposters
It's time to sign contracts and strengthen our alliance.
But as an experienced CEO, I need to do a simple background check on new hires.
Shouldn't it be enough to ask for ID? I also asked for their address,
Cryptocurrency wallet and bank account information — standard entry paperwork process.
Jack sent a driver's license from Austin, Texas (where he allegedly lives),
As well as a valid social security number and Kansas City Lead Bank bank account.
Lazarus Jack's fake driver's license
Angelo is much bolder. He claims to live in Pasadena, Texas,
But they sent me a California driver's license and a New York Citibank account.
Angelo's driving license
The most interesting part is hidden in the metadata (metadata).
Multiple EXIF entries show that the image was processed using Google Gemini.
And the SynthID watermark is embedded. Combined with obvious visual inconsistency,
The forgery was almost obvious at a glance, yet he was completely unaware of it himself.
Metadata for Angelo's driver's license
If that's bold enough, then Lucas is highly skilled.
Instead of sending documents under his name, he shared a New York driver's license belonging to Pui Chin Teoh.
And a Wise bank account.
Unlike Angelo's file, the metadata shows that this is an actual photo taken with an iPhone 15.
Unfortunately for us, the GPS coordinates have been stripped. We're guessing Pui Chin is a real person,
His driver's license was probably taken for KYC procedures or similar purposes, and this photo was later leaked and ended up in Lucas's hands.
Metadata for Lucas's driver's license
At this point,We have obtained forged identities, stolen social security numbers, mule accounts used for money laundering, and safe houses for possible helpers.
As well as cryptocurrency wallets with transaction history.
So, it's finally time for my all-star team to get started.
We're not ready to ship the laptop yet, but that's not a problem.
We told them that our vendor had set up a virtual desktop for us,
They can start working right away. That supplier is ANY.RUN.
Chapter 6: The North Korean Mission
Capturing face-to-face images is just as important as recording everything that's happening inside the machine; both provide different pieces of the same puzzle.
ANY.RUN allows us to record every file opened in the system, every network connection, and almost every click,
Not a word energy saving escapes our real-time monitoring. These examples are specially tailored for this operation and run for hours like real VDI.
We launched three separate instances, assigned each developer their own environment, and it was time to watch them work.
On the first day, Angelo and the team used almost exactly the same techniques as other North Korean hackers to scout their machines.
They first run dxdiag (DirectX diagnostic tool), systeminfo, and wmic to get system details,
Then check the geographic location they displayed by visiting a legitimate IP tracking website (IP8 this time).
Everything seemed normal, so Angelo felt safe enough to log in to his Google account.
Install Google Remote Desktop (as we saw in the first episode) and sync his account with the machine.
Yes, sync his account.
A mistake worth millions
For those unfamiliar with how Google Account Sync works, this means that all of that user's stored information will be available on this device,
This includes browsing history, search history, saved passwords, and installed extensions.
We have all his information because of just one mistake.
In previous surveys, this enabled us to identify the “Famous Chollima” toolset,
Including the AI tools they use in their job search process.
However, he didn't seem to notice; he just kept logging in to his GitHub account, and everything went as usual.
The team is moving fast on multiple fronts, but that doesn't mean they're doing the right thing.
Jack strives to create a front-end that doesn't look as one-size-fits-all as Vibe code, and the same as half of the websites on the internet.
Angelo and Lucas, on the other hand, are struggling with the backend and smart contracts.
They use Google to search for basic knowledge, such as how to build smart contracts that can be upgraded,
An existing MetaMask wallet was imported and then painstakingly collected some cryptocurrencies from the testnet faucet.
At one point, they even pasted the testnet URL into their wallet's address bar and ended up complaining to ChatGPT that “now they all need real money.”
Angelo uses ChatGPT
Next, they continued to work in their own code repository, and since they were unable to replace coins from any faucet leader, they are now only able to develop using completely fictitious assets.
At this point, we seriously doubt that this is the right business decision. Ballena Azul's earnings report for the next quarter looks bleak.
Maybe it's just that today's work isn't going well; everyone has that few days. So we decided to make things a little worse.
Previously, we introduced human faults and network outages to slow down agents.
Then immediately accuse them of “breaking” the laptop we lent them.
This time, we kept selective network interruptions while also randomly disappearing the mouse cursor.
(Angelo Debugging Selective Network Outage)
Whenever they complained, we told them that one of our vendor's IT support staff would connect to resolve the issue.
What happened next was surprisingly reminiscent of what Aaron did to Andy in the first episode.
It just happened this time between Angelo and one of our “IT support” people:Chat via Notepad.
Are you there? (Watch video on YouTube)
Their vibecoding session continues, and now they're working to fix the NPM installation glitch,
It also deals with occasional network outages, and at the same timeRemix and Visual StudioSwitch between ChatGPT results, hope everything works out.
Debugging Node.js issues with ChatGPT
They're busy, understaffed, underskilled, and the deadline for the first week is imminent,
This is the perfect time to summon an old villain in this series — “Captcha Hell.”
(Angelo is caught in an endless loop of captcha codes)
After dealing with the verification code for a few minutes, a network failure “forced the VDI to be destroyed,” and all unsaved progress instantly went to waste.
The days passed day by day, and the Millionaires ran amok in the stable, leaving behind not only erroneous codes,
There are also plenty of traces:AstrillVPN export nodes around the world, chat logs, conversations with AI agents, wallet addresses, and hours of face recordings.
(Building dreams)
But better than all of this, they revealed something even more interesting and was caught on the spot:An agent server that acts as a proxy and springboard to access VDI.
This discovery is extremely valuable because their servers tend to last a long time and are often recycled,
Sometimes multiple malware families are hosted, reflecting the evolution of their actions over time,
At the end of its lifecycle, it accumulates a large number of tags across the threat intelligence community.
This was the case with one of the servers, but the other two were almost undiscovered,
It's only labeled “scanner” (“this host performs a port scan”) and - strangely enough - a “honeypot.”
However, as the days passed, not only was our intelligence gathering growing, but Ballena Azul LTD also grew.
It grew to the point where it caught the attention of someone, someone hoping to meet the next crypto unicorn team: a VC investor.
Chapter 7: Investors
Mr. Aelin Ashriver works for Definitive Communications (Def-Comm for short),
They are also interested in funding our dreams. We have had many “drills” with the team,
Rehearse our team salute: “Hello Def Comm, we are Ballena Azul LTD!” When the big day finally arrived, everything went well.
During the meeting, Mr. Ashriver asked us if we would be interested in getting some media attention.
Mentioning that he can help, he even claims to be close to Cointelegraph.
In fact, Mr. Ashriver, Yohan Yun, Cointelegraph's Korean correspondent, has always been our accomplice.
And you, dear reader, think our plot reversal is over.
Definitive Communications decided to invest in Ballena Azul LTD
You can almost see dollar signs imprinted on their retinas.
They seem to have tasted the money rolling in. Getting one of the first jobs at a startup usually means getting a trusted position,
They can almost feel that the private keys in the cold wallet are on the tip of their feet.
We are on our way to the top. But everything that rises... will eventually fall. And so our downfall began.
Chapter 8: Lawyers
I said we have more reversals. Trust me, this isn't the last one. So far, Heiner (Andy) and I (Leonardo Nelson) have been working with Jack, Angelo, and Lucas every day.
But if you keep an eye on it, there's another name in this equation: Mr. Benito,
My co-founder (played by our friend Alejo).
He was busy working and living in Milan before, and he trusted us to take care of everything while he left.
However, when he came back, he found that we had turned the house into a stable, and he was very unhappy about it.
Mr. Anderson's Many Lives (Watch video on YouTube)
The first to escape was Angelo, completely freaked out. It took Jack a little longer to understand what was happening (mostly with real-time translation tools).
Benito made the most of this, and at a time when we couldn't hold back our laughter,
Throw out “The Matrix” trickle after another (“I'll be as candid as possible, Mr. Anderson”, “Are you living a double life, Mr. Anderson?”).
Once Jack finally understood the situation, he just left.
But that's not the end of it. Our Telegram channel became me — the betrayed CEO — and
Scolding between Andy — an employee who has a rather lax attitude towards employment law.
I accused him (Andy) of bringing in “illegal workers,” still pretending not to fully understand what really happened, and told him it would cause me trouble.
He countered that he was under a lot of pressure to quickly set up a team, and I didn't pay him enough to complete this task.
He has done his best under the current conditions.
The argument continued for a while until I decided to end not only our partnership, but also our friendship,
Tell him if he has anything else to say, through my assistant or Benito.
In a humane act that I really respect (I'm serious),Angelo contacted Andy privately
I asked him if he was okay and expressed regret for what happened between us.
We haven't heard anything from the rest of the team, and they still don't know they are being reverse spied on.
Extra Part I: Over and Over Again
If our second season doesn't have a returning character who mysteriously disappeared without a trace in the first season, then what kind of drama would it be?
By the time we formed the team, we were already mired in it and couldn't quit.
So we did what others would do in this situation: move on and recruit our fifth Beatle.
But this is your old acquaintance with us. If you listen to it yourself, you'll probably recognize that sound.
You're still alive! (Watch video on YouTube)
Aaron Schulz (North Korean hacker in the previous investigation) returned as a hero and expressed his desire to join Ballena Azul LTD.
But in the end, we had some irreconcilable differences: he failed to provide a photo ID, “We'll have to wait at least a month.
Until we can pay our first salary”. So, in the end, he only made a few cameos, but we're happy to know that he's okay.
Extra Part II: Cough Syrup
There's another fun surprise. What do you do if your real-time translation software suddenly breaks down during daily meetings?
This happened to Jack during one of our daily meetings.
We have noticed that as the order of his speeches gets closer,He seemed more and more flustered in the corner of the meeting, and we immediately understood what was wrong with him，
Most likely, it's his real-time translation tool. As a result, he dealt with the situation in a man's way:Pretend to be coughing。
Cough Syrup (Watch video on YouTube)
He's ready to pretend to faint if necessary, so we'll just pretend we haven't seen it this time.
OK, here's our last surprise, fun, or weird video.
Before we finish this episode, let's go back a little bit. Remember, as funny as these guys are, they are still a threat to our company and assets.
Maybe not voluntary, maybe not an option, but they do pose a threat.
So let's analyze their newest toolset and update what we've seen and changed since our last clash in December last year.
————————
Famous Chollima's new toolset and infrastructure
This list includes only the tools we've observed in this new chapter, and may vary over time or across agent clusters.
AnyDesk, Google Remote Desktop: remote desktop software.
AstrillVPN: VPN service.
Browser extensions: Saved Formats for GPT, Simplify Copilot, AIApply, Final Round AI.
ChatGPT: Writing and Coding They rely heavily on it to ask trivial questions about things they don't understand,
Even use it to complete work tasks instead of asking us.
Google Gemini: image modification, especially file forgery.
2fa.cn: Share two-factor authentication codes between agents.
We've noticed they're no longer using authenticator.cc or otp.ee we've seen in previous clashes.
Cursor, Visual Studio Code, and Remix: Code.
MetaMask, Bitget Wallet: cryptocurrency wallet.
ip8.com: Check their egress IP address.
Outlook.com: Previously, we only observed them using Gmail during these clashes.
System tools: dxdiag, systeminfo, wmic.
VPS: Vultr, Gorilla Servers.
This is the end of this operation. Sadly, it's time to say goodbye! Finally, I would like to remind all companies that while there is no one-size-fits-all solution, the classic strategy still applies:
Do a good background check and KYC. If you're a remote-first company, have them run regularly and include in-person verifications.
Train your recruiters to recognize red flags. They're the first line of defense to protect your company.
Immediately block AstrillVPN, as well as any services that refuse to cooperate with takedown or law enforcement requests.
If you spot a Famous Chollima member, make them truly “famous” by recording their faces and sharing them with the intelligence community.
You'll help raise awareness and possibly stop an unsuspecting company from hiring spies or even facing sanctions.
Always doubt
Don't trust anyone
Don't forget to smile, you're on camera
Twitter:https://twitter.com/BitpushNewsCN
Compare the TG exchange group:https://t.me/BitPushCommunity
Compare TG subscriptions:https://t.me/bitpush
