North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees

A joint undercover investigation has pulled back the curtain on how North Korean IT worker operatives don’t just slip past hiring checks; they settle in, gain trusted access, and quietly work from inside legitimate companies for months at a time. The research, conducted by threat intelligence specialists Mauro Eldritch (BCA LTD) and Heiner García (NorthScan), in partnership with malware analysis firm ANY.RUN, followed up on an earlier operation documenting recruitment cycles used by Famous Chollima, a group tied to the broader Lazarus ecosystem. Rather than stopping at the recruitment phase, researchers set up a complete honey-company: a decentralized finance (DeFi) startup called Ballena Azul LTD, equipped with a professional...

Read the full article at the source.