source_3905.pdf (14 MB)

BCA LTD, NorthScan, and ANY.RUN recruited DPRK-linked Famous Chollima IT workers into a controlled DeFi company and recorded their activity through monitored Windows sandboxes. The investigation exposed false-identity and facilitator arrangements, remote-access tooling, automated job-application services, VPN infrastructure, and synchronized Google-account data. Observed infrastructure included four Astrill VPN nodes and a residential IP in Vladivostok that the researchers connected to logistics and telecommunications infrastructure associated with North Korean operations. The presentation also describes linked shell-company, H-1B, and cryptocurrency-transfer patterns used to obtain and move revenue for the DPRK regime.