🕵️ How to catch a North Korean IT worker: build a fake startup

Researchers Mauro Eldritch and Heiner García set up a fictitious crypto startup called Ballena Azul and spent five weeks watching suspected DPRK developers work inside a controlled environment — none the wiser.

Three "developers," recruited via a contact linked to Famous Chollima, were given assignments and deliberate disruptions: network outages, vanishing cursors. The key find was their external servers — some already tied to malware families like BeaverTail and InvisibleFerret, others unknown to any threat feed, the kind that gets recycled across operations for years.

Cointelegraph joined one Zoom as a fake VC from the invented Definitive Communications. The suspects pitched earnestly for funding. Someone on that call was telling the truth — just not who they thought.