North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

## Executive summary: This report exposes a sophisticated DPRK-operated remote worker scheme—attributed to Lazarus/Famous Chollima—that obtains legitimate employment via forged identities and AI-assisted personas to gain persistent access to corporate and government systems; it documents recruitment tactics, malware used, network evasions, mule/payment infrastructure, and provides IOCs and SOC detection/mitigation guidance.