Famous Chollima, a North Korean cluster within the wider Lazarus ecosystem, scales recruitment-based operations by placing fraudulent IT workers inside companies and by using fake hiring processes to deliver malware. Researchers operating the fictitious DeFi company Ballena Azul hired three DPRK personas and observed forged or stolen identities, VPN and remote-desktop access, a shared 2fa.cn account platform, mule bank accounts, and extensive use of generative AI. The operatives performed mostly functional development work rather than attacking the honeypot directly, showing how the scheme monetizes trust in remote hiring and employee referrals. The article connects this model to North Korea’s broader IT-worker revenue program and Famous Chollima’s mass recruitment infrastructure.