RESEARCHERS CAPTURE LAZARUS APT'S REMOTE-WORKER SCHEME LIVE ON CAMERA

Summary from the TLDR InfoSec newsletter

Researchers from BCA LTD, NorthScan, and ANY.RUN captured Lazarus Group's Famous Chollima division operating live by deploying sandbox VMs disguised as developer workstations to trap operators targeting Western companies in finance, crypto, healthcare, and engineering sectors. The investigation revealed a toolkit focused on identity takeover rather than malware. Organizations should implement enhanced vetting for remote hires as attackers request full identity documents and 24/7 laptop access to infiltrate companies without deploying traditional malicious payloads.