Live Footage Exposes Lazarus Group’s Covert IT-Worker Pipeline Targeting U.S. Finance and Crypto Firms in a State-Backed Espionage and Funding Scheme

TL;DR: Researchers infiltrated a North Korean scheme where Lazarus Group’s Famous Chollima division hires or impersonates remote IT workers to infiltrate Western companies—especially in crypto, finance, healthcare, and engineering. The operatives use stolen identities, heavy social engineering, and remote-access tools (AnyDesk, Google Remote Desktop) rather than advanced malware. Investigators posed as recruits and lured the attackers into controlled ANY.RUN sandbox “laptops,” capturing every action, tool, message, and network request. The team documented the recruits’ attempts to gather full identity details, SSNs, bank access, and 24/7 device control. Despite poor operational security, Lazarus operators rely on persistence and convincing storytelling. The investigation gives a rare real-time inside look at how these DPRK IT-worker infiltration operations function.

Top comment by @Danicjade

More coverage

• The Lazarus Group and DPRK Crypto Theft in 2026 - Sanctions.io (sanctions.io)
• The Lazarus Group: Espionage, Sabotage, and Cybercrime Under ... (brandefense.io)
• Researchers Capture Lazarus APT's Remote-Worker Scheme Live ... (thehackernews.com)
• Alleged North Korean hackers scouted crypto exchange employees ... (cyberscoop.com)
• [PDF] How North Korea-Backed Lazarus Group Is Weaponizing Open ... (sonatype.com)