Researchers hired suspected Famous Chollima operatives into a controlled fake DeFi startup and monitored their behavior after onboarding. The workers used forged or stolen identities, mule banking details, remote-access software, AstrillVPN, AI services, development tools, and operative-controlled proxy infrastructure while accessing company systems as legitimate employees. The operation demonstrates how DPRK IT workers can obtain durable access to source code, intellectual property, and trusted engineering processes while generating revenue for the regime. ANY.RUN captured associated VPS addresses, VPN exit nodes, and cryptocurrency wallets.