NorthScan

Investigating North Korean IT Worker Infiltration

Driven by OSINT & HUMINT | Founded by @0xfigo

[NorthScan @north_scan]

🇨🇭Nuestra charla en Insomni'hack se encuentra en YouTube!

Investigación en colaboración con @MauroEldritch y @anyrun_app detallando el proceso de falsos trabajadores IT remotos norcoreanos

Allí evidenciamos este vector, detallando sus más recientes técnicas y métodos para emplearse, así como la forma de contratar proxies para asegurar un empleo.

[Mauro Eldritch 🏴‍☠️ @MauroEldritch]

🇨🇭 ¡Salimos en la portada con @0xfigo!

🇰🇵 La foto es de nuestra charla en Insomni'hack #Suiza. Filmamos por primera vez en la historia el proceso completo de infiltración de los falsos trabajadores IT remotos de #Lazarus, con entrevistas exclusivas.

⬇️ ¡No se la pierdan!

[Giveth @Giveth]

🛡️ The results for the @thedaofund’s Ethereum Security QF Round are LIVE!

This historic round is closing with a HUGE last minute contribution:

@wintermute_t has added $200K to the matching pool 🔥

Wintermute is a well known liquidity provider, and one of the leading supporters of Ethereum security, in fact exactly a year ago today they donated $1M to @_SEAL_Org.

This year they teamed up with TheDAO, @Quantstamp & several other community partners to allocate over $1.6M worth of funding to Ethereum Security Public Goods 👇

[NorthScan @north_scan]

Read the full investigation here: https://t.co/K8IePqHSe3

[NorthScan @north_scan]

New NorthScan investigation is live!

We have published a new investigation into Beejern LLC, a company established in Oklahoma, and its wider connected cluster, including DreamHi and QN Software

We mapped suspicious infrastructure overlaps, shared contact details, corporate records, GitHub personas, manipulated team imagery, and cross-platform indicators across company websites, hiring platforms, and developer profiles

Read the full investigation

[BlockOSINT @0xfigo]

🧵 New investigation: Beejern, an active Oklahoma LLC, appears linked to a suspected DPRK IT worker cluster first identified through GitHub activity

The case connects GitHub aliases, company records, Upwork activity, manipulated imagery, shared infrastructure, and external DPRK research corroboration

[NorthScan @north_scan]

Last day to support NorthScan in the @Giveth @The_DAO_Project QF round

Your support means a lot and helps NorthScan continue pushing research and resources on DPRK IT worker operations so defenders can stay informed

And a special thanks to the 13 people who have donated so far 💙

Donate here:
https://t.co/UAMY10YWxi

[thedao.fund @thedaofund]

Open-source intelligence has become a critical part of Ethereum security.

@north_scan combines onchain analysis, OSINT, and threat research to expose DPRK IT worker activity, drainer operations, and crypto fraud infrastructure.

Learn more: https://t.co/PfmVNKFycS

Support: https://t.co/23ikvMfaGI

[NorthScan @north_scan]

Thank you very much for spreading the word and opening this opportunity so initiatives like this can have more visibility!

Remember we are on @Giveth and you can donate

Even 1$ dollar can help us :)

[thedao.fund @thedaofund]

Open-source intelligence has become a critical part of Ethereum security.

@north_scan combines onchain analysis, OSINT, and threat research to expose DPRK IT worker activity, drainer operations, and crypto fraud infrastructure.

Learn more: https://t.co/PfmVNKFycS

Support: https://t.co/23ikvMfaGI

[NorthScan @north_scan]

Thanks to @buda_kyiv!! and remember we are still early to donate @Giveth @thedaofund

Even a $1 donation to Northscan can make a difference.
Support our research around DPRK It workers by donating!

[Dyma Budorin 🇺🇦 @buda_kyiv]

I watched the whole stream and learned a lot! Thank you @griffgreen and @jchaskin22

So adding donations to:
@theredguild
@l2beat
@SEAL_911 Certifications and Intel
@coinspect wallet security ranking
@anticapture
NorthScan by @0xfigo
@walletbeat
https://t.co/aKA9AbEe2Z

[NorthScan @north_scan]

@Giveth @thedaofund Link to donations: https://t.co/RtQcTo9kmJ

[NorthScan @north_scan]

Remember Northscan is in the Ethereum Security QF Round @Giveth @thedaofund (Apr 21 - May 12) and this is how quadratic funding works:

🐋 1 whale = limited matching power
🌊 100 small donors = stronger community signal

That's why even a $1 donation to Northscan can make a difference!

Please support us and donate :)

[BlockOSINT @0xfigo]

Northscan is participating in the current Ethereum Security QF Round

In quadratic funding, community support matters thus a small donation from many people can carry more weight than one large donation from a single donor

If you care about exposing DPRK IT worker operations, identity abuse, and infiltration risks, your support helps, and remember any tiny donations count! 👁️

[BlockOSINT @0xfigo]

Northscan is participating in the current Ethereum Security QF Round

In quadratic funding, community support matters thus a small donation from many people can carry more weight than one large donation from a single donor

If you care about exposing DPRK IT worker operations, identity abuse, and infiltration risks, your support helps, and remember any tiny donations count! 👁️

[NorthScan @north_scan]

@FreshelleT @Giveth @thedaofund Thank you it means a lot!! 🙏

[NorthScan @north_scan]

@The_DAO_Project @Giveth Link of project: https://t.co/RtQcTo9kmJ

[NorthScan @north_scan]

Northscan has been accepted into @The_DAO_Project Fund’s Ethereum Security QF Round

We’re building independent research focused on exposing DPRK IT worker operations, identity abuse, and infiltration risks affecting the ecosystem

The round is now live on @Giveth. In quadratic funding, and every donor matters

If you want to support this work, please donate! :)

[Mauro Eldritch 🏴‍☠️ @MauroEldritch]

🇰🇵 #Lazarus is back with a new macOS malware kit.

👷 Made up of multiple Mach-O binaries, we named it “Mach-O Man”. It is being distributed via #ClickFix in the crypto ecosystem to steal secrets.

▶️ Read my full article for ANY RUN below.

#DPRK #Malware

[780th Military Intelligence Brigade (Cyber) @780thC]

How North Korea laundered money through Vietnamese crypto company
The Korea Times
https://t.co/cyFIC4CGHt
@koreatimescokr

[NorthScan @north_scan]

https://t.co/yqVANcYYV3

[NorthScan @north_scan]

@BirminghamCyber @1ns0mn1h4ck Link: https://t.co/fxJC2C84JF

[NorthScan @north_scan]

Our talk, “Smile, you’re on camera! Livestreaming from a DPRK IT workers’ laptop farm”, is now on YouTube!

Many thanks to @BirminghamCyber and https://t.co/YpKe7AsU1x for this excellent collaboration, and @1ns0mn1h4ck for giving us the opportunity to share it

[Mauro Eldritch 🏴‍☠️ @MauroEldritch]

😃 Our talk “Smile, you’re on camera! Livestreaming from a #DPRK IT workers’ laptop farm” is now on YouTube.

🤝 NorthScan, ANY RUN and BCA LTD collaborated to document the full #FamousChollima infiltration cycle for the first time ever!

📹 https://t.co/V6wMQq3e4o

#Lazarus