Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera

According to The Hacker News, researchers have exposed one of North Korea’s most persistent infiltration schemes—a remote-worker operation linked to Lazarus Group’s Famous Chollima division, monitored live as operators worked on what they believed were real laptops. A joint investigation led by Mauro Eldritch of BCA LTD, with NorthScan and ANY[.]RUN, revealed the recruitment approach began with a recruiter posing as a U.S. developer and using the alias “Aaron” (aka “Blaze”) to woo a fake candidate.

The operators then used a virtual “laptop farm” created by ANY[.]RUN Interactive Sandbox, allowing them to interview remotely and siphon salaries back to DPRK, while the sandbox supposedly mimicked a fully active workstation. Inside the sandbox, the team observed identity takeover tools and remote access utilities, including AI-driven job automation tools and browser-based OTP generators, all routed through Astrill VPN to emulate real activity.

The researchers warn that remote hiring can provide an entry point for high-value access and internal compromises, underscoring the need for heightened awareness and safe verification for interview processes. The findings were documented in December 2025, as part of an in-depth threat intelligence collaboration.