Ballena Azul was a DeFi protocol that did not exist. It had a pitch, open developer roles, and a hiring process. It was built by Mauro Eldritch of BCA LTD, Heiner García of NorthScan, and the malware analysis firm ANY.RUN, for the specific purpose of finding out what happens after a North Korean IT worker gets hired.
Three of them did.
How they arrived
Not through a job board. A recruiter trawling GitHub for facilitators delivered the first developer. That developer vouched for a friend, who vouched for a third.
That referral chain is the operationally important detail. The screening pressure a company applies is highest on the first hire and lowest on a referral from someone already inside. The chain exploits a bias every hiring process has.
All three went through the standard sequence — interview, contract, VM access — and all three were placed before anything looked wrong.
The first ten minutes
Once they had access, the reconnaissance was immediate and unsubtle:
dxdiag
systeminfo
wmic
Machine profiling. Then a check on what country their connection appeared to originate from — verifying their own cover rather than probing the target.
One operative installed Chrome Remote Desktop and synced his personal Google account to the sandbox. That handed the researchers his browsing history, his saved passwords and his installed extensions. He also logged into GitHub on company infrastructure.
This is the kind of mistake that only shows up when someone is running many identities at once and the operational discipline thins out.
What was in the browser
The extension list is the part with the widest implications:
- AIApply
- Final Round AI
- Simplify Copilot
- A saved-prompts tool for ChatGPT
These are commercial job-application and interview-assistance products. They are not malware and they are not North Korean tooling. They are the same extensions used by ordinary candidates trying to get through the same funnel — which is exactly why they defeat the interview stage. The tell that used to work (a candidate who cannot answer follow-ups in real time) has been productised away for everybody.
Identity documents showed a second AI signal. Image metadata indicated processing with Google Gemini, and the researchers reported a SynthID watermark on the imagery.
Infrastructure ran through Vultr, Gorilla Servers and AstrillVPN exit nodes.
The detection signals that held up
| Signal | Why it works |
|---|---|
| Inconsistent location across identity documents | Hard to keep straight across many personas |
| AI-edited photographs with metadata traces | SynthID and Gemini metadata survive casual handling |
| Browser fingerprinting to verify connection origin | Legitimate candidates do not check what country they appear to be in |
| Machine-translation cadence in profile text | Consistent across the set |
| Multiple logins from different geographies in a short window | Operational, not behavioural — and logged |
The last row is the one a company can actually act on, because it does not require a human to notice anything during an interview.
On the attribution
The researchers attribute the three to suspected Famous Chollima operatives — CrowdStrike's naming, placed under the broader Lazarus umbrella.
As of 11 August 2026, no government source had confirmed that identification. We are repeating the researchers' assessment as an assessment.
For scale, a separate 2024 Justice Department case sentenced two US facilitators over a scheme that placed workers at more than 100 US companies using at least 80 stolen identities, earning North Korea over $5 million. No salary figures were published for the Ballena Azul three.
What a hiring team should change
The temptation is to treat this as an intelligence story. It is a hiring process story, and the fixes sit with people who do not read threat intel.
- Referrals are not a trust signal from a new hire. A referral from someone who has been there three weeks is a referral from a stranger.
- Instrument the first session, not the interview.
dxdiagandsysteminfoinside ten minutes of first access is a detection you can write today. Interview-stage detection is losing to commercial AI tooling and will keep losing. - Block personal account sync on company machines. The Chrome Remote Desktop mistake is what unravelled one of these operatives. It should not have been possible.
- Check document metadata. SynthID and generator metadata are cheap to look for and were present here.
- Correlate login geography across the first month. Fully remote hiring removed the physical check; nothing replaced it.
The uncomfortable framing: this operation succeeded at the hiring stage against researchers who were specifically expecting it. A company that is not expecting it is not running a harder gate.
