Researchers hired suspected North Korean IT workers to expose their post-hire playbook
Three hires used forged identities, Gemini-altered documents, remote access tools and AI coding assistants inside a sandboxed workplace.
By Ryan Merket · Published
Primary source: ANY.RUN
Why it matters
Remote hiring is an insider-security boundary: a fraudulent employee can arrive with valid credentials and legitimate access to code, wallets and internal systems.
Mauro Eldritch (@MauroEldritch) and Heiner Garcia Perez say they hired three suspected North Korean IT workers into a fake cryptocurrency startup, then recorded how the developers used forged identities, AI tools and remote access infrastructure after receiving legitimate access to the workplace.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.