Source: Cointelegraph.com NewsFor months, Cointelegraph took part in an investigation centered around a suspected North Korean operative that uncovered a cluster of threat actors attempting to score freelancing gigs in the cryptocurrency industry.
\nThe investigation was led by Heiner Garcia, a cyber threat intelligence expert at Telef\u00f3nica and a blockchain security researcher. Garcia uncovered how North Korean operatives secured freelance work online even without using a VPN.
\nGarcia\u2019s analysis linked the applicant to a network of GitHub accounts and fake Japanese identities believed to be associated with North Korean operations. In February, Garcia invited Cointelegraph to take part in a dummy job interview he had set up with a suspected Democratic People\u2019s Republic of Korea (DPRK) operative who called himself \u201cMotoki.\u201d
\nUltimately, Motoki accidentally exposed links to a cluster of North Korean threat actors, then rage-quit the call.
\nHere\u2019s what happened.
\nSuspected North Korean crypto spy posed as a Japanese developer
\nGarcia first encountered Motoki on GitHub in late January while investigating a cluster linked to a suspected DPRK threat actor known as \u201cbestselection18.\u201d This account is widely believed to be operated by an experienced DPRK IT infiltrator. It was part of a broader group of suspected operatives who had infiltrated the crypto gig economy through freelancing platforms such as OnlyDust.
\nMost North Korean state actors don\u2019t use a human face photo in their accounts, so Motoki\u2019s profile, which had one, hooked Garcia\u2019s attention.\u00a0
\n\u201cI went straight to the point and just wrote to him on Telegram,\u201d Garcia told Cointelegraph, explaining how he created an alter ego as a headhunter for a company looking for talent. \u201cIt was pretty easy. I didn\u2019t even say the company name.\u201d
\nOn Feb. 24, Garcia invited Cointelegraph\u2019s South Korean reporter to join an upcoming interview for his fake company \u2014 with the hope of speaking to the suspected DPRK operative in Korean by the end of the call.
\nWe were intrigued; if we could meet with an operative, we had the opportunity to learn just how effective these tactics were and, hopefully, how they can be counteracted.
\nOn Feb. 25, Garcia and Cointelegraph met Motoki. We kept webcams off, but Motoki did not. During the interview, conducted in English, Motoki often repeated the same responses for different questions, turning the job interview into an awkward and stilted conversation.
\nMotoki displayed questionable behavior inconsistent with that of a legitimate Japanese developer. For one, he couldn\u2019t speak the language.
\nRelated: From Sony to Bybit: How Lazarus Group became crypto\u2019s supervillain
\nWe asked Motoki to introduce himself in Japanese. The screenlight reflecting off his face suggested he was frantically searching through tabs and windows to find a script to help him answer.
\nThere was a long, tense silence.
\n\u201cJiko sh\u014dkai o onegaishimasu,\u201d Cointelegraph repeated the request, this time in Japanese.
\nMotoki frowned, threw off his headset, and left the interview.
\nMotoki sensed something was off moments before leaving the interview.Compared to bestselection18, Motoki was sloppy. He revealed key details by sharing his screen in the interview. Garcia theorized that Motoki is likely a lower-level operative working with bestselection18.
\nMotoki had two calls with Garcia, one of which was with Cointelegraph. In the two calls,\u00a0his screenshare revealed access to private GitHub repositories with bestselection18 for what Garcia calls a defunct scam project.
\n\u201cThat\u2019s how we linked the whole operation and the whole cluster\u2026 He shared his screen and revealed he was working with [bestselection18] in a private repo,\u201d Garcia said.
\nLinguistic clues point to North Korean origins
\nIn a 2018 study, researchers observed that Korean males tend to have wider, more prominent facial structures than their East Asian neighbors, while Japanese males typically have longer, narrower faces. While broad generalizations, in this case, Motoki\u2019s appearance aligned more closely with the Korean profile described in the study.
\n\u201cOkay, so let me introduce myself. So, I am an experienced engineer in blockchain and AI with a focus on developing innovation and impactful products,\u201d Motoki said during the interview, his eyes scanning from left to right as if reading a script.
\nAn ID card submitted to Garcia by Motoki in his job application. Source: KetmanMotoki\u2019s English pronunciation offered more clues. He frequently pronounced words beginning with \u201cr\u201d as \u201cl,\u201d a substitution common among Korean speakers. Japanese speakers also struggle with this distinction but tend to merge the two sounds into a neutral flap.
\nHe seemed more relaxed during personal questions. Motoki said he was born and raised in Japan, had no wife or children, and claimed native fluency. \u201cI like football,\u201d he smiled, pronouncing it with a strong \u201cp\u201d sound \u2014 another hint more typical of Korean-accented English.
\nRelated: The whale, the hack and the psychological earthquake that hit HEX<\/p>\n
Motoki unveils one more North Korean tactic Source: Cointelegraph.com NewsFor months, Cointelegraph took part in an investigation centered around a suspected North Korean operative that uncovered a cluster of threat actors attempting to score freelancing gigs in… <\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/128703"}],"collection":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128703"}],"version-history":[{"count":0,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/128703\/revisions"}],"wp:attachment":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128703"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nAbout a week after the interview with Cointelegraph, Garcia attempted to prolong the charade. He messaged Motoki and claimed that his boss had fired him due to the dubious interview.
\nThat led to three weeks of private message exchanges with Motoki. Garcia continued to play along, pretending Motoki was a Japanese developer.
\nGarcia later asked Motoki for help finding a job. In response, Motoki offered a deal that provided additional insight into some of North Korea\u2019s operational methods.
\n\u201cThey told me they would send me money to buy a computer so they could work through my computer,\u201d Garcia said.
\nThe arrangement would allow the operator to remotely access a machine from another location and carry out tasks without needing a VPN connection, which can trigger issues on popular freelancing platforms.
\nMotoki attempts to access a US-based PC through remote applications like AnyDesk. Source: KetmanGarcia and his partner published their findings on the cluster of suspected DPRK operatives tied to bestselection18 on April 16 on open-source investigative platform Ketman.
\nA few days later, Cointelegraph received a message from Garcia: \u201cThe guy we interviewed is gone. All his socials changed. All the chats and everything around him has been deleted.\u201d
\nMotoki has not been heard from since.
\nSuspected DPRK operatives have become a recurring problem for recruiters across tech industries. Even major crypto exchanges are targeted. On May 2, Kraken reported it identified a North Korean cyber spy attempting to land a job at the US crypto trading platform.
\nA United Nations Security Council report estimates that North Korean IT workers generate up to $600 million annually for the regime. These spies are able to funnel consistent wages back to North Korea. The UN believes those funds help finance its weapons program \u2014 which, as of January 2024, is thought to include more than 50 nuclear warheads.
\nMagazine: Lazarus Group\u2019s favorite exploit revealed \u2014 Crypto hacks analysisRead More<\/a><\/p>","protected":false},"excerpt":{"rendered":"