Home›Crypto›Market Structure›Fake crypto startup used to track North Korean IT work…

Fake crypto startup used to track North Korean IT workers

Investigators say the ruse revealed external server infrastructure tied to malware used in credential and crypto wallet theft.

Reported · Written up by our desk · Market Structure

Cointelegraph describes a months-long investigation in which suspected North Korean IT workers were brought into a fake crypto startup and unknowingly had their actions tracked to collect intelligence.

In June, a reporter joined a Zoom call posed as a venture capitalist, meeting the Ballena Azul development team under the cover of the fictitious Definitive Communications. The operation was built to study the workers methods and infrastructure, according to the outlet.

Cointelegraph says the fake Ballena Azul project was constructed by cybersecurity founder Mauro Eldritch and Heiner García, a cyber threat intelligence analyst at Telefónica Tech and founder of NorthScane. The scheme used infrastructure provided by cybersecurity platform ANY.RUN, and a previously registered UK company name added apparent legitimacy.

A key piece of intel, the outlet reports, involved external servers used as intermediary points before connecting to virtual desktops controlled by the investigators. Cointelegraph adds that García linked those servers to malware families tied to North Korean campaigns that steal credentials, crypto wallet data, and other sensitive information.

More like this

Sources