{"id":17149,"date":"2025-12-04T11:51:50","date_gmt":"2025-12-04T11:51:50","guid":{"rendered":"\/cybersecurity-blog\/?p=17149"},"modified":"2025-12-08T09:35:07","modified_gmt":"2025-12-08T09:35:07","slug":"lazarus-group-it-workers-investigation","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/lazarus-group-it-workers-investigation\/","title":{"rendered":"Smile,\u00a0You’re\u00a0on\u00a0Camera:\u00a0A\u00a0Live\u00a0Stream from Inside\u00a0Lazarus Group\u2019s\u00a0IT Workers\u00a0Scheme\u00a0"},"content":{"rendered":"\n

Editor\u2019s note: <\/em><\/strong>This work is a collaboration between Mauro Eldritch from BCA LTD, a company dedicated to threat intelligence and hunting, Heiner Garc\u00eda from NorthScan, a threat intelligence initiative uncovering North Korean IT worker infiltration, and <\/em>ANY.RUN<\/a>, the leading company in malware analysis and threat intelligence<\/em>. <\/p>\n\n\n\n

The article was written by Mauro and Heiner.<\/em><\/p>\n\n\n\n

In this article, we’ll uncover an entire North Korean infiltration operation<\/strong> aimed at deploying remote IT workers<\/strong><\/a> across different companies in the American financial and crypto\/Web3 sectors<\/strong>, with the objective of conducting corporate espionage <\/strong>and generating funding<\/strong> for the sanctioned regime. We attributed this effort to the state-sponsored APT<\/strong> (Advanced Persistent Threat) Lazarus<\/strong><\/a>, specifically the Famous Chollima<\/strong><\/a> division. <\/p>\n\n\n\n

Key Takeaways <\/h2>\n\n\n\n