Executive Summary
Security researchers successfully conducted a honeypot operation by creating a fake DeFi startup, Ballena Azul LTD, which attracted and 'hired' multiple IT workers suspected of belonging to the Famous Chollima cluster (a division of the Lazarus Group). The investigation revealed that these North Korean operatives prioritize obtaining remote developer positions to gain long-term, legitimate access to internal systems and intellectual property while funnelling salaries back to the DPRK regime.
The operatives utilized a sophisticated support network involving remote facilitators, forged US and state-level identification, and mule bank accounts at institutions like Lead Bank and Citibank. Technical analysis of their workflow showed a heavy reliance on AI tools for live interview translation and code generation, combined with remote desktop software and VPNs to mask their true location while accessing company VDIs.
This campaign highlights a critical business risk where threat actors bypass traditional perimeter security by becoming trusted employees. Once embedded, they can influence engineering decisions, conduct unauthorized code reviews, and position themselves to drain cryptocurrency wallets, making robust KYC and periodic in-person background checks essential for remote-first organizations.