North Korean Hackers Exposed Through Fake DeFi Startup
A recent investigation by BCA LTD's Mauro Eldritch, NorthScan's Heiner García, and ANY.RUN exposed suspected North Korean IT workers posing as developers at a fake DeFi startup.
The researchers created Ballena Azul LTD, a protocol serving cryptocurrency whales, to attract the suspects. They used legitimate corporate branding, website, and UK company registration to make it seem real. The team members posed as founders and team lead during interviews with potential hires.
Angelo Cruz, a recruiter met on GitHub, supplied the first developer, who recommended two others. All three cleared interviews and received access to virtual desktops controlled by the researchers. They used ANY.RUN sandbox platform to record every move of the operatives.
The developers submitted forged US credentials during onboarding, including driver's licenses with metadata processed using Google Gemini. The researchers also found that the workers leaned heavily on AI, using ChatGPT to write code and complete assignments.