Specialists from BCA LTD, NorthScan and ANY.RUN carried out an operation in which they set up a fake DeFi startup called Ballena Azul and hired three developers whom the researchers believe to be North Korean IT specialists, presumably linked to the Famous Chollima group. The candidates went through the full hiring cycle and received access to corporate virtual machines that recorded their every action. The experiment made it possible to thoroughly document their tooling, operational security and the typical mistakes such “employees” make—information that is useful for any company hiring remote developers.
How the hiring scheme works
According to the researchers, the first candidate was brought in by a recruiter who was looking for developers on GitHub. Then a referral chain kicked in: the first candidate recommended the second, and the second recommended the third. This “snowball” model is typical of operations run by North Korean IT cells, where several operators work in a coordinated way and share infrastructure.
Even at the document submission stage the researchers recorded numerous inconsistencies:
- Candidate #1 claimed to live in Pasadena, Texas, but provided a California driver’s license and a bank account in New York. According to the researchers, the image metadata for the license indicated it had been processed via Google Gemini, and the image itself contained a SynthID watermark—a system for tagging AI-generated content.
- Candidate #2 provided a Texas driver’s license, a valid Social Security number, and a bank account in Kansas City.
- Candidate #3 sent a New York driver’s license that belonged to another person. The photo was taken on an iPhone 15, but the GPS coordinates had been removed from the metadata.
The use of generative AI to forge documents is a relatively new element in the toolkit of such operations. The presence of a SynthID watermark suggests that the operators either did not know it existed or did not know how to remove it.
Actions after gaining access
On the very first working day, all three developers performed the same sequence of actions on the issued virtual machines: they ran the dxdiag, systeminfo and wmic commands to collect system information and then checked the geolocation of their IP address. Such synchrony points to a standardized procedure that the operators follow.
One of the workers made a critical operational security mistake: he installed Chrome Remote Desktop and synchronized his personal Google account with the work virtual machine. This exposed to the researchers his browsing history, saved passwords and installed extensions. He also logged in to GitHub from this same machine.
Tooling and infrastructure
Browser analysis revealed a set of tools that, according to the researchers, North Korean operators use to secure employment at scale:
- AIApply, Final Round AI, Simplify Copilot — services for automating job applications and interviews using AI
- An extension with saved prompts for ChatGPT
- The 2fa.cn service — for relaying two-factor authentication codes
The operators’ network traffic reportedly passed through AstrillVPN exit nodes—a VPN service that has repeatedly appeared in reports on North Korean cyber operations. The group’s infrastructure was linked to the hosting providers Vultr and Gorilla Servers.
The 2fa.cn domain deserves special attention: using a Chinese service to transmit two-factor authentication codes allows operators located in the DPRK to receive verification codes tied to U.S. phone numbers without having to be physically present in the United States.
The scope of the threat
Schemes involving the employment of North Korean IT specialists in foreign companies have been documented for several years. Such workers can install malware on work devices, steal data from corporate networks and extort their employers. At the same time, some of them do in fact perform their assigned tasks, and the money they earn is routed to organizations linked to the DPRK authorities.
The scale of the problem is illustrated by a case brought by the U.S. Department of Justice: in April 2026, sentences were handed down to two U.S. citizens who helped place North Korean operators in more than 100 U.S. companies, using at least 80 stolen identities. According to the investigation, the scheme brought North Korea more than $5 million.
Recommendations for protection
Based on the results of the study, several specific measures can be highlighted for companies that hire remote developers:
- Checking documents for signs of AI generation: analyze ID image metadata for SynthID watermarks and traces of processing by generative models
- Cross-checking data: compare the state of residence, the state that issued the documents and the location of the bank account—geographic mismatches are a strong indicator
- Live verification: where possible, conduct at least one video verification with location confirmation before granting access to corporate systems
- Monitoring workstations: track the execution of reconnaissance commands (dxdiag, systeminfo, wmic) and the installation of remote access tools in the first days of work
- Controlling VPN traffic: block or monitor connections via AstrillVPN on corporate devices
- Repeat checks: identity verification should not be limited to the moment of hiring—carry out periodic checks of existing remote employees
- Training recruiters: HR specialists should know the typical signs of forged documents and referral chains
This study is one of the few documented operations in which defenders deliberately created a controlled environment to observe suspected North Korean operators. Although attribution to a specific group remains unconfirmed by independent sources, the identified tactics, tools and operational security mistakes have practical value. Companies that hire remote developers should adopt cross-checking of documents and image metadata analysis as a standard part of the hiring process—this is the most effective early-stage barrier against such schemes.
