Inside the Scheme: Fake Crypto Startup Recruited North Korean IT Workers

A painstaking investigation into crypto-focused recruitment tactics has exposed how suspected North Korean IT workers operate when they think they’re joining a legitimate startup. In a ruse carried out over five weeks, researchers built a fictitious company called Ballena Azul and invited suspected operatives to develop software and complete tasks inside controlled virtual environments—allowing analysts to observe their day-to-day tooling, workflows, and infrastructure choices.

As described in reporting by Cointelegraph, the project was designed and executed by Mauro Eldritch, founder of cybersecurity firm BCA LTD, and Heiner García, a cyber threat intelligence analyst at Telefónica Tech and founder of NorthScane. The operation leveraged infrastructure from cybersecurity platform ANY.RUN, and Cointelegraph joined for one stage of the contact with the supposed hiring team.

Key takeaways

• Researchers used a fake crypto startup, Ballena Azul, to study suspected DPRK recruitment and working methods inside controlled virtual desktops.
• One of the most valuable findings was the use of external intermediary servers—some linked to earlier North Korean malware campaigns that were still active.
• The suspected workers often relied heavily on AI tools to compensate for technical gaps and to help with coding, writing, and document manipulation.
• The scheme showed how threat actors can pose as employees to gain access to internal systems, code, and credentials without deploying malware immediately.
• Earlier cases reported by US and industry entities indicate this approach is evolving, spanning remote access strategies and identity manipulation.

From recruitment to “startup” onboarding

The Ballena Azul operation began when García connected with a recruiter via GitHub, after the recruiter was associated with Famous Chollima, a threat group linked to DPRK IT-worker activity. According to García, the startup needed software developers, and the recruiter offered multiple names for candidates—at least two of whom presented US identification.

As the interviews and onboarding progressed, the researchers used aliases to maintain the deception. Eldritch took on the persona of co-founder “Leonardo Nelson,” while García posed as “Andy Jones,” the team lead. Developers were assigned programming tasks inside controlled virtual desktop environments, which enabled the researchers to monitor what tools they reached for, how they responded when problems appeared, and how they handled technical obstacles.

To test the candidates’ responses, the researchers deliberately introduced issues, including selective network outages and changes to user interaction cues such as disappearing mouse cursors. In García’s account, the biggest surprise wasn’t only the tooling—it was the lack of a uniform corporate process. Instead, he described a pattern of improvisation rather than a rigid playbook.

Infrastructure clues and the “reuse” problem

Beyond the day-to-day behavior of the operatives, the investigation highlighted the role of infrastructure “in-between” moments. During the ruse, analysts identified external servers that acted as intermediary points before suspected workers connected to the controlled virtual desktops used by the researchers.

García told Magazine that some of those servers were associated with malware families tied to prior North Korean campaigns, including InvisibleFerret and BeaverTail/OtterCookie. He said at least some of the intermediary servers were still active, suggesting that operational components can remain in use for extended periods—an issue that matters for defenders because long-lived infrastructure increases the window for compromise and detection evasion.

At the same time, García noted that other servers appeared entirely new from an intelligence perspective, “clean” and not previously documented in mainstream threat feeds or blocklists. That combination—some reuse of known infrastructure alongside previously unseen resources—underscores why investigations focused only on established indicators may miss portions of an operation.

“Some of the servers we found were tied back to distributing InvisibleFerret and BeaverTail/OtterCookie in prior years and were active to this day,” García said, adding that others were not previously tied to intelligence tracking.

AI-assisted impersonation and credential theft risk

The working environment also revealed how the operatives attempted to maintain productivity. The researchers found extensive use of AI tools for coding and other tasks that candidates struggled to complete on their own. According to García, they used ChatGPT for writing and coding, including help answering basic questions and finishing assignments. For image alteration and document forgery, García said the group showed a preference for Google Gemini.

The investigation also documented the wider operational toolkit suspected workers used: remote desktop software, crypto wallets, and services designed for sharing two-factor authentication codes. The implication is not simply that these actors can deploy malware, but that they may not need to—once hired, they can use legitimate access to reach sensitive internal information. Researchers described the long-term advantage as well: staying undetected allows threat actors to collect salaries for as long as they remain in place, which can support DPRK funding objectives.

Cointelegraph’s reporting situates this in a broader pattern of AI adoption across DPRK-linked activity. The same piece points to Reuters reporting that another North Korean hacking group, Kimsuky, uses AI locally to automate parts of cyberattacks and generate more convincing phishing materials. While those accounts involve different operators and likely different goals, together they suggest a trend toward integrating generative tools into cyber workflows.

How the ruse unraveled—and what stayed hidden

After weeks of tasks inside the controlled environments, researchers staged an internal disruption to force the operatives to react. They introduced a new persona—“Benito Camella,” a co-founder who supposedly had been busy in Milan while hiring accelerated. When Camella “returned,” the confrontational sequence was meant to expose inconsistencies in identity and documentation.

During the confrontation, the chat room rapidly emptied. One developer, Espree, left the video call first, while another, Anderson, stayed longer before realizing the scheme was collapsing. Even after the meeting ended, the researchers maintained the facade through company communications: the fake CEO accused “Andy Jones” of bringing in “illegal workers,” and “Jones” responded that he was pressured to build quickly and believed he was not being compensated adequately.

That staged dispute ended with “termination” of the working relationship and friendship, framing the collapse as the result of a hiring disaster. Afterward, one suspected operative contacted García privately to apologize and check whether he was okay. Researchers said they never heard from the rest of the group again, and—importantly—believe the operatives remained unaware that they had spent weeks helping analysts extract intelligence.

Why this matters for crypto and broader cybersecurity

North Korea-linked IT-worker schemes have increasingly been linked to threats against the cryptocurrency sector and beyond. Cointelegraph notes industry and government-linked reporting that shows how these operations can involve recruiting developers through intermediary channels, using remote-access pathways to appear legitimate, and targeting organizations for access to internal systems and sensitive data.

Earlier examples referenced in the same reporting include ConsenSys’ statement in July that it engaged a North Korea-linked developer through a third-party service provider before cutting off access. The piece also highlights a US Justice Department case alleging nearly $1 million in cryptocurrency theft by four North Korean nationals charged in connection with remote job fraud using false identities. Separately, the US Treasury has stated that North Korean IT-worker schemes generated nearly $800 million in 2024 to support the regime’s weapons-of-mass-destruction programs.

For crypto investors, operators, and builders, the practical takeaway is that supply-chain and workforce risk remains as relevant as direct hacking. Even without an immediate malware payload, credential exposure and internal access can provide a pathway to funds and sensitive operational data—especially when attackers use “legitimate work” as cover for months-long persistence.

As defenders analyze what the Ballena Azul ruse exposed—especially intermediary server reuse and AI-enabled workflow patterns—the next step for organizations will be to tighten verification and monitor remote-access and identity controls continuously, not only when known indicators appear. The most uncertain element for now is how quickly threat actors will adapt their operational tooling and infrastructure in response to investigations like this one.