Inside the fake crypto startup that fooled North Korean IT workers
Suspected North Koreans IT workers joined a fake crypto startup — without realizing their every move was being tracked to extract valuable intel.
A fake crypto startup named Ballena Azul deceived suspected North Korean IT workers into believing they were seeking venture capital funding. Cybersecurity firms Mauro Eldritch and Heiner García set up the ruse to gather intelligence on the workers' methods and infrastructure. Eldritch played the role of Leonardo Nelson, while García took on the identity of Andy Jones.
The operation lasted five weeks and exposed valuable intel, including servers associated with malware families linked to North Korean campaigns. The workers relied on AI tools like ChatGPT and Google Gemini to compensate for their technical knowledge gaps. North Korean IT workers have increasingly posed a cybersecurity threat to the cryptocurrency industry, with some generating nearly $800 million in 2024 to fund North Korea's weapons of mass destruction programs.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
