Researchers posed as founders of a fake DeFi startup (Ballena Azul LTD) and hired three suspected Famous Chollima operatives, observing their behavior inside controlled ANY.RUN sandbox environments. The operatives used AI-generated identity documents, proxy VPS infrastructure, AstrillVPN exit nodes, and remote desktop tools to access company systems. The investigation exposed operative infrastructure including DPRK-operated VPS servers, cryptocurrency wallets, and a shared 2FA platform (2fa.cn), along with the operatives' evolving toolset for coding, document forgery, and interview assistance.
Lazarus Group
1 post
Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup