The GitHub Diaries: Tracking DPRK IT Workers Across GitHub
A series of short investigations into North Korean IT workers using GitHub to build fake identities, manufacture credibility, and infiltrate companies.
Smile, You're on Camera: A Live Stream from Inside Lazarus Group's IT Workers Scheme
Unprecedented investigation capturing live video footage and real-time activity from inside a North Korean IT worker operation, revealing the full scope of their infiltration tactics and remote work schemes.
Smile, you're on camera! Livestreaming from North Korea's IT workers laptop farm
Mauro Eldritch and Heiner Garcia present exclusive findings at Insomni'hack 2026 in Lausanne, Switzerland. Live recordings from a sandboxed laptop farm and unedited conversations with North Korean handlers.
Smile, You're on Camera — Live from Inside a DPRK Laptop Farm at DEF CON 34
NorthScan's Heiner García and Mauro Eldritch take the DEF CON 34 Main Stage with recorded interactions with DPRK operatives and live footage from a fake laptop farm. Saturday, August 8, 2026 at 15:00 · LVCC West Hall, Main Track 5.
Featured Threat Research
In-depth analysis of DPRK-linked cyber operations and emerging threat landscapes
From North Korean IT Workers to IT Recruiters
Investigation into how North Korean IT workers are evolving their tactics by posing as IT recruiters, systematically harvesting identities on freelance platforms to infiltrate organizations worldwide.
Fraud Alert: Fake recruiters on GitHub and LinkedIn
Exposing fraudulent recruiter profiles on GitHub and LinkedIn used by threat actors to target developers and infiltrate organizations through social engineering tactics.