Malik Haidar stands at the intersection of corporate resilience and global threat intelligence, having spent years shielding multinational corporations from high-tier adversary groups. His work often involves dissecting the subtle behavioral shifts of state-sponsored actors who trade traditional malware for more insidious methods of infiltration. In this discussion, we dive into the chilling reality of a recent operation where security researchers built a “honeypot” crypto startup to catch North Korean operatives in the act of being hired. We explore the sophisticated blend of AI-assisted deception, the technical footprints of state-sponsored IT workers, and the massive financial scale of these identity-theft schemes.
The conversation centers on the evolving landscape of remote hiring security, the specific red flags found in forged documentation, and the rigorous reconnaissance these operatives perform the moment they gain access to a corporate environment.
When remote candidates present mismatched documentation, such as a Texas residence paired with a California driver’s license or a New York bank account, what does this reveal about the underlying sophistication and the potential gaps in current corporate vetting processes?
These discrepancies are the first cracks in a carefully constructed facade, revealing a high-volume operation that occasionally stumbles over its own logistical complexity. In the case of the researchers’ fake startup, Ballena Azul, one hire claimed Pasadena, Texas, as home while providing a New York bank account—a massive red flag that many automated systems might miss if they aren’t looking for regional consistency. It highlights a desperate need for human intuition in the vetting process, as these operatives are often managing multiple identities simultaneously to maximize their reach. For a hiring team, seeing a valid Social Security number paired with a bank account from a completely different state, like Kansas City, should trigger an immediate, deep-dive investigation rather than a routine check-mark. We are seeing a shift where technical skills are no longer the only thing being evaluated; the geographical and financial footprint of the candidate has become a primary battlefield for security.
The discovery of Google Gemini metadata and SynthID watermarks in candidate documents is a fascinating technical catch; how are AI tools changing the arms race between state-sponsored actors and cybersecurity researchers?
The use of AI is a double-edged sword that has dramatically lowered the barrier for creating “authentic-looking” forgeries, but it also leaves behind a digital trail that we are just beginning to learn how to track. When researchers found that image metadata pointed toward Google Gemini processing, it was a “smoking gun” moment that proved the documents were not just scanned, but algorithmically enhanced or generated. The presence of a SynthID watermark—an invisible marker Google embeds in its AI-generated content—is particularly telling because it shows that even the most disciplined operatives can be undone by the very technology they use to deceive us. However, we must remain vigilant because a negative result for a SynthID watermark doesn’t mean the image is legitimate; it just means it wasn’t edited by Google’s specific models. This creates a sensory-rich environment for investigators who must now act like digital forensic artists, looking for the “uncanny valley” in a driver’s license or the GPS coordinates stripped from an iPhone 15 photograph.
Once an operative successfully clears the hiring process and gains access to a virtual machine, what specific technical maneuvers should security teams be looking for during those critical first hours of “reconnaissance”?
The moment an operative logs in, the “onboarding” turns into a tactical survey of the environment, and the speed at which they move can be quite jarring for an unprepared IT team. We saw these three suspected Famous Chollima operatives immediately run commands like dxdiag, systeminfo, and wmic to profile the hardware and software limitations of their assigned sandboxes. They aren’t just setting up their IDE; they are checking the boundaries of their cage and verifying the country of their connection to ensure their VPN isn’t leaking their true location. One of the most brazen moves observed was an operative installing Chrome Remote Desktop and syncing his personal Google account, effectively merging his personal history and saved passwords with the company’s infrastructure. It’s a gut-wrenching realization for a security lead to see a “trusted” employee immediately attempt to bypass internal controls to establish a persistent, hidden bridge to the outside world.
Given that separate schemes have already earned North Korea over $5 million through the use of stolen identities at over 100 U.S. companies, how does this financial scale change our understanding of the “insider threat”?
The $5 million figure is a staggering reminder that this isn’t just about corporate espionage or data theft; it’s a systematic, state-sanctioned revenue stream that funds an entire national apparatus. When you realize that 80 stolen identities were used to infiltrate more than 100 companies, the “insider threat” stops being a disgruntled employee and starts being a professionalized, high-yield industry. This scale suggests that the operatives are often working under parent agencies, remitting their salaries back to North Korea, which adds a layer of emotional weight to every payroll transaction a company makes. Each successful hire isn’t just a security risk—it’s a direct financial contribution to a sanctioned regime’s treasury. It forces us to view the hiring process not as a HR function, but as a critical component of national security and anti-money laundering efforts.
What is your forecast for the evolution of state-sponsored IT worker programs in the next few years?
I anticipate that we will see these operatives move away from “off-the-shelf” AI tools like Gemini that leave detectable watermarks and instead shift toward proprietary, localized generative models to create even more convincing deepfake personas. The “Famous Chollima” and Lazarus umbrella groups are incredibly adaptive, and as we begin to block exit nodes for services like AstrillVPN, they will likely pivot to more residential-looking proxy networks that are harder to distinguish from legitimate remote worker traffic. We will also see a rise in “facilitator” roles—Westerners who rent out their identities and physical addresses for a cut of the salary, making the initial documentation checks even harder to fail. The battle will move further into the realm of behavioral biometrics and “continuous identity,” where we don’t just verify a person at the point of hire, but constantly validate that the person typing on the keyboard is the same one we interviewed. If we don’t evolve our verification methods to be as persistent as the threat itself, the $5 million we’ve seen stolen so far will seem like a drop in the bucket compared to what’s coming.
