Home / Technology / Fake Startup Traps Rogue North Korean Hackers
Fake Startup Traps Rogue North Korean Hackers
11 Aug
Summary
- Researchers created a fake startup to lure and monitor North Korean IT workers.
- Suspects used fake IDs and relied on AI tools like ChatGPT for their work.
- The operation aimed to expose tactics used to fund North Korea's regime.
Cybersecurity researchers have exposed tactics employed by North Korean IT professionals infiltrating remote jobs. To achieve this, researchers Heiner García and Mauro Eldritch from Birmingham Cyber Arms LTD created a fictitious startup named Ballena Azul. This fake company posed as a decentralized finance firm targeting cryptocurrency, a known funding source for the North Korean regime.
The researchers contacted a recruiter on GitHub, a platform utilized by North Koreans seeking remote employment. They subsequently hired three individuals who claimed to be US residents, presenting forged or stolen identification. During interviews, the suspects exhibited behaviors suggestive of using translation tools and avoided sophisticated deepfake technology to mask their identities.
Using specialized monitoring software, the researchers tracked the hired individuals, who utilized AstrillVPN for covert operations and ChatGPT extensively for job tasks. Evidence also indicated struggles with basic coding tasks and cryptocurrency acquisition from testnet faucets. These findings were presented at the DEF CON hacking convention, highlighting the ongoing threat of North Korean IT infiltration, even into government roles.
