Researchers built a fake crypto startup, hired three suspected North Korean developers, and watched
2026-08-12World
Ballena Azul did not exist. The recruitment did. Three developers came through a referral chain, signed contracts, got VM access — and within minutes ran dxdiag and checked which country their connection appeared to come from.