Researchers Create Fake Startup to Identify Suspected North Korean IT Workers

Undercover Operation to Expose North Korean Tactics

Security researchers from BCA LTD, the NorthScan initiative, and ANY.RUN created a fictional decentralized finance (DeFi) protocol called Ballena Azul. They advertised developer jobs and successfully hired three individuals suspected of being North Korean operatives. Every virtual machine provided to these hires was recorded to monitor their activities.

Suspicious Onboarding and Digital Forensics

The hiring process revealed several red flags. One applicant claimed to live in Texas but provided a California driver's license and a New York bank account. The image metadata for this license indicated it was processed with Google Gemini and contained a SynthID watermark, an invisible marker embedded by Google's AI tools. Another applicant provided a New York license belonging to someone else, while a third supplied a Texas license, a valid Social Security number, and a Kansas City bank account.

While Google's Gemini app can detect SynthID watermarks from its own AI models, a negative result does not exclude the use of other AI editing tools.

Understanding the Threat

The researchers noted that these schemes pose a significant hiring risk, as successful placements grant operatives legitimate employee accounts and access to source code and internal systems. A joint alert from July 31 highlighted that North Korean IT workers seek contracts to remit their salaries to North Korean agencies and often use forged or altered documents. This operation follows a previous one where researchers posed as a facilitator for such workers.

Initial Actions of the Operatives

Upon gaining access to their work virtual machines, all three operatives immediately conducted reconnaissance. They ran commands such as dxdiag, systeminfo, and wmic to profile their assigned machines, indicating an initial phase of information gathering rather than immediate exploitation.