Researchers Infiltrate DPRK IT Worker Scheme, Exposing Lazarus-Linked Operatives’ Tools and Infrastructure

Aug 10, 2026 · Original article ↗

Summary

Researchers posed as a DeFi startup to hire suspected Famous Chollima operatives and monitor their work, documenting forged identities, remote-access practices, tools, infrastructure, and risks from trusted insider access.

Key points

Researchers created a fake DeFi startup and hired three suspected Famous Chollima operatives, monitoring their activity in controlled virtual desktops.
The investigation documented forged or misused identity documents, suspected stolen personal data, mule bank accounts, and cryptocurrency wallets.
Operatives used remote desktop software, AstrillVPN, AI tools, coding software, crypto wallets, and system utilities; one synced a Google account on a monitored machine.
Researchers observed VPS infrastructure used as proxies and vantage points to access the virtual desktops, and published associated IP addresses and wallet indicators.
The report warns that DPRK IT workers can gain sustained, legitimate access to company systems, source code, intellectual property, and trusted business processes.
Recommended safeguards include background checks and KYC, periodic in-person identity verification, recruiter training, and sharing evidence with the intelligence community.

Article Details

Attack Vectors: Famous Chollima operatives allegedly sought long-term access to Western companies by applying for remote developer roles using forged identities and résumés, proxy interviews, remote facilitators, and ghost developers.
After being hired, operatives used their legitimate employee access to company systems, code repositories, and business processes.
The investigation observed operatives using remote desktop software, VPN exit nodes, and shared 2FA-code services as part of their workflow.
Defensive Notes: Perform background checks and KYC, with periodic checks and in-person identity verification for remote-first companies.
Train recruiters to recognize indicators of fraudulent identities and proxy interviews.
Block AstrillVPN, as recommended by the article, and review services that do not cooperate with takedown or law-enforcement requests.
If suspected Famous Chollima operatives are identified, record relevant evidence and share it with the intelligence community.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]250[.]148[.]58`	Identified as an AstrillVPN exit node used in the operatives' activity.
IPV4	`107[.]150[.]38[.]250`	Identified as an AstrillVPN exit node used in the operatives' activity.
IPV4	`185[.]152[.]67[.]39`	Identified in the article's IOC list as a DPRK-operated VPS used as operative infrastructure.
IPV4	`192[.]200[.]115[.]226`	Identified as an AstrillVPN exit node used in the operatives' activity.
IPV4	`199[.]168[.]112[.]175`	Identified as an AstrillVPN exit node used in the operatives' activity.
IPV4	`206[.]217[.]134[.]34`	Identified as an AstrillVPN exit node used in the operatives' activity.
IPV4	`45[.]77[.]71[.]42`	Identified in the article's IOC list as a DPRK-operated VPS used as operative infrastructure.
IPV4	`89[.]187[.]185[.]11`	Identified in the article's IOC list as a DPRK-operated VPS used as operative infrastructure.