{"id":1165,"date":"2026-08-12T10:10:38","date_gmt":"2026-08-12T08:10:38","guid":{"rendered":"https:\/\/familiebuckens.nl\/?p=1165"},"modified":"2026-08-17T10:11:25","modified_gmt":"2026-08-17T08:11:25","slug":"smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake-defi-startup","status":"publish","type":"post","link":"https:\/\/familiebuckens.nl\/index.php\/2026\/08\/12\/smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake-defi-startup\/","title":{"rendered":"Smile, You\u2019re on Camera. Part 2: Hiring Lazarus APT\u2019s IT Workers in a Fake DeFi Startup"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Back in December, we were the first ever to fully record the Famous Chollima infiltration cycle. From recruiting collaborators to help them land jobs at Western companies, to forging documents, shipping laptops to facilitators\u2019 houses, and even using AI tools for live assistance and translation during interviews.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During that investigation, we posed as facilitators willing to take job interviews and lend them laptops so they could find a job in exchange for a percentage of their salaries. The trick was that those laptops were actually <a href=\"http:\/\/any.run\/\">ANY.RUN<\/a> <a href=\"https:\/\/any.run\/features\/?utm_source=li_csh&amp;utm_medium=newsletter&amp;utm_campaign=lazarus&amp;utm_content=features&amp;utm_term=120826\">sandbox environments<\/a>, recording every click and every movement they made. This gave us tons of indicators, endless hours of laptop and face-to-face footage, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/lazarus-group-it-workers-investigation\/?utm_source=li_csh&amp;utm_medium=newsletter&amp;utm_campaign=lazarus&amp;utm_content=blog&amp;utm_term=120826\">an unprecedented investigation <\/a>that made it to the top of many media outlets.<\/p>\n\n\n<a class=\"wp-block-read-more\" href=\"https:\/\/familiebuckens.nl\/index.php\/2026\/08\/12\/smile-youre-on-camera-part-2-hiring-lazarus-apts-it-workers-in-a-fake-defi-startup\/\" target=\"_self\"><a href=\"https:\/\/www.linkedin.com\/pulse\/smile-youre-camera-part-2-hiring-lazarus-apts-workers-w6c4e\/\">(10) Smile, You\u2019re on Camera. Part 2: Hiring Lazarus APT\u2019s IT Workers in a Fake DeFi Startup | LinkedIn<\/a><span class=\"screen-reader-text\">: Smile, You\u2019re on Camera. Part 2: Hiring Lazarus APT\u2019s IT Workers in a Fake DeFi Startup<\/span><\/a>","protected":false},"excerpt":{"rendered":"<p>Back in December, we were the first ever to fully record the Famous Chollima infiltration cycle. From recruiting collaborators to help them land jobs at Western companies, to forging documents, shipping laptops to facilitators\u2019 houses, and even using AI tools for live assistance and translation during interviews. During that investigation,&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,8,17],"tags":[72,39],"class_list":["post-1165","post","type-post","status-publish","format-standard","hentry","category-geopolitics","category-phishing","category-vulnerability","tag-72","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/comments?post=1165"}],"version-history":[{"count":1,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1165\/revisions"}],"predecessor-version":[{"id":1166,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1165\/revisions\/1166"}],"wp:attachment":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/media?parent=1165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/categories?post=1165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/tags?post=1165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}