SMILE, YOU'RE ON CAMERA: A LIVE STREAM FROM INSIDE LAZARUS GROUP'S IT WORKERS SCHEME

Summary from the TLDR InfoSec newsletter

Researchers trapped North Korean operatives from Lazarus Group's Famous Chollima division inside an extended ANY.RUN sandbox environments, documenting their full operational workflow for infiltrating Western companies as remote IT workers. The operators recruit developers via GitHub spam. They offer 20-35% salary cuts in exchange for using victims' identities and laptops for job applications, relying on AI interview tools, AstrillVPN, and remote access software rather than malware. Poor operational security allowed researchers to delay, monitor, and ultimately expose the scheme targeting the finance, crypto, and healthcare sectors.