Researchers spotted Lazarus’s remote IT workers in action

Researchers exposed a Lazarus scheme in which North Korea-linked operators used remote IT workers to infiltrate Western organisations, with the joint investigation led by NorthScan and ANY[.]RUN and citing TheHackerNews as reporting source. The operation began when NorthScan’s Heiner García posed as a U.S. developer targeted by a recruiter known as “Aaron/Blaze,” who offered 35% of a salary for letting Lazarus operators use their laptops to infiltrate companies.

The researchers captured the process in controlled sandbox environments, using a laptop farm built from ANY[.]RUN virtual machines that simulated real developer workstations complete with browsing history, tools, and a U.S. residential proxy. They found the toolkit focused on stealing identities and taking over remote machines rather than deploying malware, aided by AI job-automation apps such as Simplify Copilot, AiApply and Final Round AI to fill out applications and generate interview responses.

The operation relied on Chrome profile syncing, OTP generators for 2FA, Google Remote Desktop, and PowerShell with a fixed PIN to maintain control, with all connections routed through Astrill VPN. The findings emphasise that the actors aimed to obtain identity and workstation access rather than plant malware, underscoring the need for awareness and safer reporting of suspicious contacts.