Security researchers conducted a controlled operation posing as recruiters for a job interview, during which they asked “Motoki” to share code samples and repository access. Analysis of the GitHub links revealed connections to the DPRK-linked threat actor “bestselection18” through overlapping IP footprints and commit signatures.
Further forensic investigation traced cryptocurrency transactions tied to those repositories, linking stolen funds to known Lazarus Group wallets. This multifaceted approach combined social engineering with blockchain analysis to unmask the malicious actor.
