Livestreaming From North Korea's IT Workers Laptop Farm
Mauro Eldritch analyzes Livestreaming From North Korea's IT Workers Laptop Farm.
Summary
North Korean IT worker threat
Mauro and Einar Garcia Perez at Insomnihack detail Famous Chollima, a Lazarus-linked unit conducting remote IT worker fraud, corporate espionage, and revenue generation for the DPRK regime across finance, healthcare, engineering, and expanding sectors including real estate and pharma.
Honeypot operation
In a first-of-its-kind sting with Finers, BCIT, and ANY.RUN, they built a fake laptop farm/sandbox mimicking contractor environments, monitored GitHub recruitment spam, infiltrated handler networks, and recorded operatives from initial login through job-scam attempts.
GitHub tradecraft
Stage one tracked GitHub spammers using repetitive outreach templates, cloned profile images, rapid follower inflation, and clustering of related accounts. Stage two containment observed full attacker behavior inside isolated ANY.RUN laptop sandboxes, yielding technical indicators for defenders hiring remote developers.
Related talks
Black Hat·45 min
Avi Sambira
Industry experts analyze emerging threats surrounding SecTor 2025 | Unmasking a North Korean IT Farm.
Black Hat·38 min
Presenters detail vulnerability discovery and exploitation in From Zero to Sixty: The Story of North Korea's Rapid Ascent to Becoming a Global Cyber Superpower.
TROOPERS IT Security Conference·54 min
Florian Grunow · Niklaus Schiess
Florian Grunow details TR17 - Exploring North Korea's Surveillance Technology.