We unmasked a highly skilled North Korean operative, part of a global billion-dollar fraud empire, and the way it happened is a masterclass in irony.
It wasn't a high-level government sting that brought them down, it was a quest for free GTA 5 cheats.

By downloading a "Mod Menu" infected with the LummaC2 infostealer, the operator’s local facilitator inadvertently handed us the keys to their entire operation. Through the exfiltrated logs, we saw the operative's entire browsing history, every raw search query, and their active session cookies.

This research by Hudson Rock serves as a perfect technical compliment to the foundational work by our customer, Kudelski Security, and their "DPRK Fake IT Workers Fraud Playbook." While they mapped the recruitment networks, our telemetry provides the "smoking gun" look at their daily operations.

Notable Findings from the Operative's Machine:

Deepfake Orchestration: Active use of ElevenLabs and AI voice generators to pass live video interviews with Western HR departments.

Exchange Cloning: Procurement of "Steal-U" malicious smart contracts and clones of major exchange interfaces like Binance and OKX.

Behavioral Mimicry: A tactic called "IP Seasoning," where the operative mixed sophisticated Mandarin coding sessions with localized Indonesian searches for football and prayer times to trick fraud filters.

This discovery proves that identity is the new corporate perimeter. By analyzing cybercrime telemetry, we can pull back the curtain on even the most disciplined state-backed actors.