{
  "id": 555624,
  "title": "Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup",
  "url": "https://urgent.news/2026/08/11/smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-11T07:42:30.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake-defi-startup?source=rss"
  },
  "original_language": "en",
  "account": "In this report, we delve into the second episode of the Smile, You’re on Camera series, which focuses on the hiring of suspected Lazarus APT IT workers in a fake DeFi startup. The investigation was conducted by Mauro Eldritch from BCA LTD and Heiner García from NorthScan, utilizing ANY.RUN sandbox environments to monitor the operatives' activities.\n\nThe story begins with the creation of Ballena Azul LTD, a DeFi protocol designed to attract developers who could access significant funds. The team behind Ballena Azul aimed to build a platform that combined NFTs and on-chain mechanisms to help whale wallets publicly signal ownership. The goal was to reduce market speculation and prevent rumors of exchange hacks or other events that could trigger panic among the crypto community.\n\nThe team employed various tactics to lure their targets, including a professional website, corporate branding, documentation, and an online presence. They also sought experienced developers to help build the platform. To maintain the illusion of legitimacy, the team forged documents and used ghost developers to create the appearance of a well-established operation.",
  "summary": "Researchers infiltrated a fake DeFi startup to expose Famous Chollima's DPRK IT worker tactics, tools, infrastructure, and insider-threat risks.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}