Smile, youre on camera Livestreaming from North Koreas IT workers laptop farm

The talk follows two researchers who tracked a North Korean IT worker division, described as a sub-group of Lazarus, that places operatives in Western companies to send revenue to the regime and gain footholds for espionage. Earlier, the team had interviewed recruits who offered to lend their identities to fake applicants. For a second phase, they set up a fictional crypto firm, hired the operatives, and gave them virtual desktops running inside a sandbox that logged every click, file open and network connection.

The recordings showed daily routines: the workers checked whether they were being sandboxed, synced browser passwords and cookies to personal accounts, and installed AI tools for auto-filling applications and live interview translation. They also shared remote-access software, one-time password apps and a commercial VPN. Outside the sandbox, open-source work linked the VPN exit nodes and a residential address to a Russian logistics figure near Vladivostok, and mapped many shell companies that reused the same websites, phone numbers and addresses. Payment trails hopped through several privacy services to send small sums.

The speakers closed with practical advice for employers: run recurring in-person identity checks, block known anonymizing VPN ranges, and remember that operatives are human and can be questioned about everyday habits. Fuller footage and details were promised in a follow-up article.