North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees

HomeCyber Security News North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees By Guru Baran August 13, 2026 North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees A joint undercover investigation has pulled back the curtain on how North Korean IT worker operatives don’t just slip past hiring checks; they settle in, gain trusted access, and quietly work from inside legitimate companies for months at a time. The research, conducted by threat intelligence specialists Mauro Eldritch (BCA LTD) and Heiner García (NorthScan), in partnership with malware analysis firm ANY.RUN, followed up on an earlier operation documenting recruitment cycles used by Famous Chollima, a group tied to the broader Lazarus ecosystem. Rather than stopping at the recruitment phase, researchers set up a complete honey-company: a decentralized finance (DeFi) startup called Ballena Azul LTD, equipped with a professional website, branding, and a plausible blockchain pitch. Ballena Azul Registration Document (Image Source: ANY.RUN) The goal was to attract real Famous Chollima operatives as job applicants and observe their post-hire activities in granular detail. North Korean IT Workers Use AI-Forged IDs Posing as founders and technical leads, researchers connected on GitHub with a recruiter linked to the group. The recruiter introduced a series of developers who vouched for one another, creating a small internal network that mirrored standard DPRK placement schemes once a foothold is established. Three operatives were ultimately hired across smart contract, frontend, and backend development roles. Standard onboarding paperwork exposed the fabricated nature of the workers’ identities almost immediately. One submitted driver’s license contained EXIF metadata confirming it was generated using Google Gemini and stamped with a SynthID watermark, demonstrating sophisticated AI document forgery. DPRK Operatives (Image Source: ANY.RUN) Another document belonged to a real individual, indicating the use of stolen or leaked identity material. Instead of shipping physical laptops, the research team provided virtual access via isolated sandbox environments that resembled a virtual desktop infrastructure. As detailed in the ANY.RUN Undercover Investigation Report, researchers recorded every file opened, command executed, and network connection initiated without exposing real corporate assets. Ballena Azul NFT Marketplace (Image Source: ANY.RUN) The captured telemetry revealed a standardized operational toolkit: Initial Reconnaissance: Executing basic system commands and verifying external IP addresses via lookup sites. Remote Management: Installing Google Remote Desktop and syncing personal Google accounts to exfiltrate passwords and browsing histories. Generative AI Assistance: Utilizing ChatGPT to troubleshoot development tasks and write code. Real-Time Translation: Deploying live translation software to bypass English fluency barriers during team meetings. Network analysis also revealed AstrillVPN exit nodes, proxy servers used to access virtual desktops, and recycled infrastructure with existing threat intelligence tags confirming that operatives regularly reuse tools across distinct DPRK cyber threats. Operational Vector Tools & Infrastructure Used Primary Purpose Identity Creation Google Gemini, SynthID, Stolen IDs Creating plausible onboarding personas Remote Control Google Remote Desktop, AstrillVPN, Vultr Establishing persistent remote access Development Assistance ChatGPT, Live Translation Software Coding, troubleshooting, and translation Infrastructure Outlook.com, 2fa.cn, Gorilla Servers Account management and multi-factor authentication Unlike traditional malware intrusions aimed at immediate exploitation, this infiltration style relies on long-term patience. Embedded operatives gain sustained access to proprietary source code, internal communications, and software deployment pipelines while drawing steady salaries that fund regime activities. When multiple operatives infiltrate a single organization, they can influence code reviews and pull requests without triggering security alarms. Addressing these complex insider threat risks requires organizations to treat hiring verification as a continuous process rather than a one-time onboarding checkpoint. Earlier researchers posed as a facilitator to expose how operatives like “Blaze” recruit intermediaries, rent stolen identities, and remotely operate hijacked laptops via AnyDesk and Google Remote Desktop, revealing an AI-driven job-application toolkit and reliance on Astrill VPN.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Tags cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Security News Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks Cyber Security Trezor ShipMonk Data Breach Exposes Personal Data of Over 13,000 Hardware Wallet Customers Cyber Security News CISA Warns of Windows Ancillary Function 0-Day Vulnerability Exploited in Attacks Cyber Security News GitLab 19.2.2 Patches 13 Security Flaws, Including High-Severity XSS and CI/CD Authorization Flaws Cyber Security News Jewelbug APT Hijacks Browsers to Steal Cookies and Spy on Government Networks Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?