Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup
Researchers infiltrated a fake DeFi startup to expose Famous Chollima's DPRK IT worker tactics, tools, infrastructure, and insider-threat risks.
In this report, we delve into the second episode of the Smile, You’re on Camera series, which focuses on the hiring of suspected Lazarus APT IT workers in a fake DeFi startup. The investigation was conducted by Mauro Eldritch from BCA LTD and Heiner García from NorthScan, utilizing ANY.RUN sandbox environments to monitor the operatives' activities.
The story begins with the creation of Ballena Azul LTD, a DeFi protocol designed to attract developers who could access significant funds. The team behind Ballena Azul aimed to build a platform that combined NFTs and on-chain mechanisms to help whale wallets publicly signal ownership. The goal was to reduce market speculation and prevent rumors of exchange hacks or other events that could trigger panic among the crypto community.
The team employed various tactics to lure their targets, including a professional website, corporate branding, documentation, and an online presence. They also sought experienced developers to help build the platform. To maintain the illusion of legitimacy, the team forged documents and used ghost developers to create the appearance of a well-established operation.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
