Researchers Catch Lazarus Group’s Recruitment Workflow on Camera via Honeypot

A groundbreaking collaborative investigation by Mauro Eldritch of BCA LTD, ANYRUN, and NorthScan has lifted the curtain on North Korean threat actors from the Lazarus Group, revealing their recruitment tactics and operational methods in unprecedented detail. The research team documented the complete attack cycle in real-time, capturing live footage of attackers actively working on compromised systems and preparing cyber operations against Western targets. The Recruitment Deception The investigation began when a recruiter operating under the alias “Blaze” approached researchers with a proposal typical of Lazarus’s social engineering playbook. The threat actor offered operators 35 percent of a salary in exchange for access to laptops to “work in,” a euphemism for providing infiltrated corporate systems. Salary Claim Rather than refuse the proposition, the security team deployed a sophisticated trap. Researchers provisioned ANYRUN sandboxed environments meticulously designed to mimic legitimate work computers. These environments recorded all attacker activity while maintaining the illusion of authentic targets. This honeypot strategy proved effective throughout the operation, as attackers remained confident in their targets despite their sophisticated operational security awareness. Over several months embedded within Lazarus’s fake hiring pipeline, researchers documented what they describe as the complete Chollima attack cycle, the group’s multi-stage methodology for conducting cyber espionage and network infiltration operations. 🔥 After months inside The footage captured attackers demonstrating their tooling, operational tactics, and specific targeting patterns. This represents the first documented case of Lazarus operators being recorded conducting actual attack preparation activities. The investigation revealed sophisticated operational security practices alongside recruitment deception. ‼️🇰🇵 And another North Korean state-sponsored hacker caught trying to get that sweet Western money for the great, yet petty, Kim Jong-un.Meet “Jesús Sebastián” from Barranquilla, Colombia. Does he speak Spanish? I don’t think so. Attackers demonstrated familiarity with standard evasion techniques and awareness of typical honeypot indicators. Yet the sandboxed environment successfully maintained its trust throughout the extended operation, allowing researchers to observe their complete workflow. According to CyberSecurityNews, the Lazarus Group’s reliance on recruited insiders marks a critical evolution in their attack methodology. Rather than conducting purely remote operations, the group actively seeks legitimate employment positions or partnerships to facilitate unauthorized network access. This tactic fundamentally challenges traditional perimeter defense assumptions. It demonstrates how threat actors blur the line between external and insider threats. This recruitment approach suggests that North Korean operations are expanding beyond their traditionally documented focus on zero-day exploits and supply chain attacks. The group is diversifying its initial-access vectors, recognizing that compromised insiders provide sustained network presence and trusted credentials. Security researchers and enterprise defenders should recognize that job postings and recruitment outreach from unfamiliar technical positions warrant verification, particularly in sensitive sectors. The investigation underscores how threat actors systematically leverage legitimate employment processes as attack vectors, targeting security-conscious organizations through their own hiring pipelines. The collaborative research represents a significant contribution to understanding Lazarus Group’s infrastructure and evolving operational capabilities. Technical indicators from the investigation are expected to be released shortly, providing defenders with actionable intelligence for detection and prevention strategies. Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.