Fake crypto startup tracks North Korean IT workers for intel

A fake crypto startup was used to infiltrate suspected North Korean IT workers and map how they operate. In June, researchers had a reporter join a Zoom call posing as “Aelin Ashriver,” an investor from the fictitious “Definitive Communications,” to recruit developers for the fake project “Ballena Azul.” The goal of the fake crypto startup was to observe working methods, infrastructure, and data the operatives left behind. Researchers (Mauro Eldritch of BCA LTD and Heiner García of Telefónica Tech and founder of NorthScane) say the workers spent about five weeks in controlled virtual desktops. The operation revealed high-value external servers used as intermediary points and linked to prior North Korea-linked malware activity, including InvisibleFerret and BeaverTail/OtterCookie. The researchers also found “new-looking” infrastructure that avoided mainstream blocklists, suggesting the threat actor can rotate resources. The fake crypto startup also showed tradecraft: suspected workers could compromise organizations for internal access and sensitive data without deploying malware. They relied heavily on AI tools such as ChatGPT for coding and basic tasks, and Google Gemini for image alteration and document forgery. They also used remote desktop software, crypto wallets, and services for two-factor authentication (2FA) code sharing. The wider context is rising financial impact from North Korean IT worker schemes, including claims of nearly $800 million generated in 2024 to fund Pyongyang’s weapons programs and recent US charges alleging $900,000+ in crypto theft. While this is not a protocol or token event, the fake crypto startup underscores ongoing credential/phishing and wallet-targeting risks that can affect exchange and institutional risk management in the short term.