1. X
  2. NorthScan
Log inSign up
NorthScan
71 posts
Image
user avatar
NorthScan
@north_scan
Investigating North Korean IT Worker Infiltration Driven by OSINT & HUMINT | Founded by @0xfigo
◾◾◾
northscan.co
Joined May 2021
53
Following
176
Followers
RepliesRepliesMediaMedia
  • user avatar
    NorthScan
    @north_scan
    11h
    🔥 New investigation out We went undercover to investigate the Famous Chollima / DPRK IT worker scheme by creating a fake startup and hiring remote workers connected to the operation Working with @BirminghamCyber and @anyrun_app, we were able to observe their activity firsthand
    user avatar
    ANY.RUN
    @anyrun_app
    12h
    🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit. @BirminghamCyber & @north_scan used #ANYRUN Sandbox to capture weeks of Famous Chollima activity inside a fake startup. 👀 How not to let a spy in? See full story and videos: any.run/cybersecurity-…
    Image
  • user avatar
    NorthScan
    @north_scan
    Aug 6
    First time at @defcon and glad to share a new fresh article coming soon...
    user avatar
    BlockOSINT
    @0xfigo
    Aug 6
    First time at @defcon and glad to have this beauty in my hands 🔥
    Image
  • user avatar
    NorthScan
    @north_scan
    Jul 23
    NorthScan is growing 🔎 With support from the Ethereum Security QF round hosted through @Giveth, NorthScan received community donations and matching funds to strengthen our research A special thank you to @thedaofund @Quantstamp and @wintermute_t for their major contributions,
  • user avatar
    NorthScan
    @north_scan
    Jul 9
    🧵 New investigation: Fake personas on GitHub building trust through open-source activity, suspicious contribution patterns, and coordinated account behavior This research looks at GitHub activity linked to a suspected DPRK IT worker cluster and how fake developer personas
    user avatar
    BlockOSINT
    @0xfigo
    Jul 9
    🙏Glad to share a new series of short investigations into North Korean IT workers using GitHub to build fake identities, manufacture credibility, and infiltrate companies: The GitHub Diaries of DPRK IT workers
    Image
  • user avatar
    NorthScan
    @north_scan
    Jun 1
    🇨🇭Nuestra charla en Insomni'hack se encuentra en YouTube! Investigación en colaboración con @MauroEldritch y @anyrun_app detallando el proceso de falsos trabajadores IT remotos norcoreanos Allí evidenciamos este vector, detallando sus más recientes técnicas y métodos para
    user avatar
    Mauro Eldritch 🏴‍☠️
    @MauroEldritch
    Jun 1
    🇨🇭 ¡Salimos en la portada con @0xfigo! 🇰🇵 La foto es de nuestra charla en Insomni'hack #Suiza. Filmamos por primera vez en la historia el proceso completo de infiltración de los falsos trabajadores IT remotos de #Lazarus, con entrevistas exclusivas. ⬇️ ¡No se la pierdan!

Log in or sign up for X

See what’s happening and join the conversation

Continue with phone
or
Log in with username or email
Terms·Privacy·Cookies·Accessibility·Ads Info·© 2026 X Corp.
Advertisement
Advertisement