Researchers set up a fake crypto startup "Ballena Azul" to trap suspected North Korean IT workers, successfully extracting key intelligence.

TechFlow reports, August 12, according to Cointelegraph, Mauro Eldritch, founder of cybersecurity company BCA LTD, and Heiner García, network threat intelligence analyst at Telefónica Tech, jointly set up a fake crypto startup "Ballena Azul", successfully luring suspected North Korean IT workers to work in a controlled virtual desktop environment for up to five weeks while monitoring their behavior throughout.

The investigation revealed that the external servers used by the workers were linked to North Korean cyber operation infrastructure previously used to distribute malware such as InvisibleFerret, BeaverTail, and OtterCookie; the workers also heavily relied on ChatGPT for assisted programming and Google Gemini to forge identity documents. Researchers pointed out that North Korean IT workers obtain remote jobs by forging U.S. identities, and the resulting salaries ultimately flow to the Pyongyang regime's weapons of mass destruction projects. According to U.S. Treasury Department data, such schemes generated nearly $800 million for North Korea in 2024.