Researchers Hired North Korean IT Operatives via Fake Crypto Startup in Security Sting

Cybersecurity researchers set up a fictitious cryptocurrency startup and advertised developer roles, ultimately hiring three individuals suspected of being North Korean IT operatives. The suspects gained entry not through hacking but by submitting job applications, passing interviews, signing contracts, and receiving legitimate system access. Investigators noticed red flags during onboarding, including geographic inconsistencies in identification documents and the use of a Social Security number linked to mismatched locations. Once given virtual machines, the workers quickly gathered system information, installed remote-access software, and connected personal accounts to corporate devices. The case highlights the need for continuous behavioral monitoring and Zero Trust principles that extend well beyond the initial hiring and authentication stages.