Ballena Azul: a fake DeFi employer used to test hiring risk
Security researchers created a shell cryptocurrency startup called Ballena Azul, advertised developer positions, and ran a complete hiring cycle to observe what a placement by suspected foreign IT workers would look like in practice. Each of the three operatives the team hired cleared interviews, signed contracts and received access to a work virtual machine (VM) — and, the researchers write, "nobody exploited anything." The exercise was intended to surface the signals an employer might see when a placement is a covert operative rather than a conventional contractor.
Onboarding artifacts and VM reconnaissance
The researchers recorded detailed onboarding artifacts. The first hire claimed to live in Pasadena, Texas, and supplied a California driver's license plus a New York bank account; image metadata showed it had been processed with Google Gemini and contained a SynthID watermark, the team reported. The second candidate supplied a Texas license, a valid Social Security number and a bank account in Kansas City. The third provided a New York license that belonged to someone else and a genuine iPhone 15 photograph with GPS coordinates stripped.
All three ran system-profiling commands on day one — dxdiag, systeminfo and wmic — and checked what country their network connections appeared to originate from. One operator installed Chrome Remote Desktop, synced a personal Google account to the sandbox and thereby exposed browsing history, saved passwords and installed extensions; that same operator logged into GitHub on the sandbox VM. The researchers emphasize that a successful placement gives "a real employee account and real access to source code and internal systems."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTooling, infrastructure and digital traces
The engagement showed a shift in operational tooling compared with an earlier operation the investigators ran: they observed 2fa.cn used to pass two-factor codes between operators, where the December operation had used authenticator.cc and otp.ee. Outlook.com appeared in communications where previously only Gmail had been used. Browser extensions designed to aid job applications and interviews were present, including AIApply, Final Round AI, Simplify Copilot and a saved-prompts tool for ChatGPT.
Infrastructure traces included hosts on Vultr and Gorilla Servers and exit nodes tied to AstrillVPN. The vendor Silent Push has separately tracked Astrill as a fixture of North Korean operations, the researchers note. The July 31 advisory accompanying the work also flags other signals: single accounts accessed from many addresses in a short window and profile text that reads like machine translation.
Gemini metadata, SynthID watermark, and evidentiary limits
The report presents two image-based findings: the image metadata showing processing with Google Gemini, and a SynthID watermark, which Google embeds invisibly in images its AI tools create or edit. The researchers note Google’s Gemini app can check for a SynthID watermark but that the watermark only indicates content created or edited by Google's AI models; a negative result does not rule out editing with other tools. The report presents the Gemini-processing metadata and the SynthID finding as separate items but does not explain how the watermark itself was detected.
Attribution: researchers, naming conventions, and government alerts
The operation and its attribution rest with the investigative team — Mauro Eldritch of BCA LTD, Heiner García of NorthScan, and the malware-analysis provider ANY.RUN — who presented their work at DEF CON 34 in Las Vegas. The team describes the three hires as suspected Famous Chollima operatives, and places that activity under a wider Lazarus umbrella. The cybersecurity vendor CrowdStrike has used the Famous Chollima name for a North Korean IT worker operation, the report notes.
Separately, an eleven‑government July 31 alert referenced the broader hiring risk but did not name a vendor actor cluster. As of August 11, no government source reviewed for this reporting had confirmed the researchers' identification. The real names behind the three personas remain unknown, and the report provides no dates for how long Ballena Azul operated.
What this means for employers, technologists, and policymakers
- Employers and recruitment teams: The researchers advise periodic identity checks rather than a single verification at hire, in-person verification for remote-first companies, and recruiter training to spot forged or edited documents and profile text that looks like machine translation.
- Technologists and security teams: The investigators recommend blocking AstrillVPN exit nodes and watching for account behavior such as single accounts reached from many addresses in a short window; the VM recordings in this exercise show how quickly sensitive artifacts (saved passwords, browsing history, GitHub sessions) can be exposed if an operator synchronizes personal accounts to work sandboxes.
- Policymakers and law enforcement: The report sits beside other enforcement actions: in April the Justice Department sentenced two U.S. facilitators in a separate scheme that leveraged stolen identities to place workers at more than 100 U.S. companies and earned North Korea more than $5 million. The researchers' operation follows a prior December effort in which they posed as a facilitator and was covered by The Hacker News.
The work offers a concrete demonstration: when a remote placement is successful, access is real and expected, and the signs can be subtle — processed image metadata, VPN exit nodes, atypical two‑factor tooling and synced personal accounts. The researchers handed employers a checklist of signals and controls; they also left open a practical question the report itself highlights: who will validate those signals at scale, and which organizations will act when a pattern appears?
