Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

Researchers created a fake DeFi startup to recruit suspected Lazarus (Famous Chollima) operatives, recording their recruitment, onboarding, remote-access workflows and toolset inside ANY.RUN sandbox VDIs; the investigation exposes long-term insider threat risks from DPRK IT worker placement, documents forged identities and mule accounts, lists observed tools (VPNs, remote desktop, AI image editing, ChatGPT, MetaMask) and provides IOCs including multiple IP addresses and Ethereum addresses.