Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

MITRE Techniques

• [T1133 ] External Remote Services – Operatives used remote access tools and VPNs to enter and work inside the virtual desktops (‘installed Google Remote Desktop’; ‘AstrillVPN exit nodes everywhere’).
• [T1090 ] Proxy – They routed access through intermediary infrastructure to reach the VDIs (‘operative servers used as proxies and vantage points to jump into the VDIs’).
• [T1036 ] Masquerading – They used forged identities, fake documents, and false company/persona details to appear legitimate (‘forged identities, fake résumés’; ‘driver’s license’).
• [T1588.001 ] Obtain Capabilities: Malware – The group’s supporting infrastructure and tools were collected and analyzed as part of their operational stack (‘we observed in this new episode’).
• [T1219 ] Remote Access Software – They installed and used remote access software to maintain control and work remotely (‘AnyDesk, Google Remote Desktop: Remote desktop software’).
• [T1056 ] Input Capture – The operation relied on captured interactions and live monitoring of every click and movement inside the environment (‘recording every click and every movement they made’).
• [T1119 ] Automated Collection – The sandbox captured extensive activity and data automatically during their use of the VDI (‘record every file opened, every network connection, and virtually every click made’).
• [T1082 ] System Information Discovery – They ran system reconnaissance commands to inspect the host environment (‘dxdiag, systeminfo, and wmic to get a detailed overview of the system’).
• [T1016 ] System Network Configuration Discovery – They checked their apparent location and exit IP using IP lookup services (‘checked where in the world they appeared to be by visiting legitimate IP lookup websites’).
• [T1078 ] Valid Accounts – They logged into real Google and GitHub accounts on the provided environment (‘open his Google account’; ‘logging into his GitHub account’).
• [T1027 ] Obfuscated Files or Information – They used image processing and watermarking to alter or disguise identity documents (‘processed with Google Gemini, and a SynthID watermark had been embedded’).
• [T1110 ] Brute Force – The article references repeated CAPTCHA challenges and login-like verification pressure, but not password guessing; no clear direct use was shown, so this technique is not confidently supported.
• [T1562.001 ] Disable or Modify Tools – They disrupted work through selective outages and cursor disappearance, reducing usability of the environment (‘we kept the selective network outages’; ‘made the mouse cursor disappear randomly’).