Fake Crypto Startup Lures North Korean IT Workers for Five Weeks

Researchers used a decoy firm to monitor suspected DPRK operatives, linking them to malware infrastructure and AI-assisted identity fraud funding state programs.

Woofun AI reports that Mauro Eldritch of BCA LTD and Heiner García of Telefónica Tech established a fictitious cryptocurrency venture named 'Ballena Azul' to entrap suspected North Korean IT personnel. The operatives worked within monitored virtual environments for up to five weeks, revealing connections to servers previously utilized for distributing InvisibleFerret, BeaverTail, and OtterCookie malware.

The investigation indicated that these workers employed ChatGPT for coding assistance and Google Gemini to fabricate identity documents, enabling them to secure remote positions under false U.S. identities. Treasury data confirms that such illicit employment schemes generated nearly $800 million for North Korea in 2024, with proceeds directed toward weapons of mass destruction programs.