Cybersecurity researchers exposed North Korean operatives using fake infrastructure to steal crypto and credentials via a decoy startup.
Cybersecurity researchers created a fictitious crypto startup, Ballena Azul, to lure suspected North Korean IT workers seeking venture capital. The five-week operation revealed servers used as intermediaries for malware distribution, including tools linked to credential and crypto wallet thefts.
The decoy startup leveraged an existing but dissolved UK company registration to appear legitimate. Researchers identified servers tied to known malware families like InvisibleFerret and BeaverTail, some of which remained active for years without detection.
Some infrastructure discovered was entirely new, with no prior intelligence or presence on threat blocklists. The operation highlighted the recycling of servers across multiple North Korean cyber campaigns.