The Deepfake Threat: Chollima APT Group Uses AI Filters to Infiltrate Crypto and Web3 Companies

The rapid expansion of remote work and hiring has exposed companies, particularly in high-value sectors like Crypto and Web3, to sophisticated new forms of social engineering. The Chollima Synthetic Interview Operation reveals how advanced persistent threat (APT) groups are exploiting remote hiring processes using real-time deepfakes and stolen identities to conduct espionage and steal funds.

This campaign, linked to North Korean state-sponsored actors, highlights a crucial shift in cyberattack methodology: utilizing AI-powered facial filters during live video interviews to masquerade as legitimate job candidates.

According to the full campaign report, Chollima operatives used fake résumés and real-time AI facial filters to impersonate qualified job candidates during interviews. They connected via VPNs and remote desktop tools that masked their true location creating the illusion of being U.S.-based professionals. Once an interview ended, online profiles like LinkedIn were immediately deleted, leaving minimal traces. This method showcases a deeply orchestrated infiltration tactic designed to bypass digital HR screening.

10 Critical Questions on the Chollima Deepfake Campaign

1. Who is responsible for the Chollima Synthetic Interview Operation?

Lazarus Group threat actor card

This campaign is attributed to the Famous Chollima APT group, a known subdivision of the Lazarus Group, one of the most active and persistent threat actors linked to North Korea. Lazarus has a long record of conducting espionage, cyber-theft, and disruptive attacks against global targets.

For a detailed breakdown of Lazarus Group’s history, structure, and tactics, readers can exploreSOCRadar’s Lazarus Group profile, which provides deeper intelligence and recent updates on their operations.

2. What was the core goal of the operation?

The primary goal was to secure roles inside Western firms—specifically as software engineers—to conduct espionage and steal funds. The operators aimed to gain inside information for spying and financial theft.

3. Which sectors were primarily targeted by Chollima?

The group primarily focused on sectors including Crypto, Web3, Finance, Human Resource Consulting Services, and Software Publishers. Recent reports also indicate they have begun targeting civil engineering and architecture positions.

4. What sophisticated technology did the operatives use?

The Chollima operators utilized AI face filters and AI-driven deepfakes that worked in real time during video calls to disguise their faces and mimic the professionals whose identities they had stolen.

5. How did the threat actors acquire the identities they used?

Attackers stole the real résumés and identities of professionals. In documented cases, they used the stolen identities of two Mexican engineers, Mateo and Alfredo, to participate in interviews.

6. How did the attackers attempt to conceal their true location?

To achieve geographical camouflage and appear as legitimate, US-based remote candidates, the operatives used a complex infrastructure. This involved connecting through the Astrill VPN (often used by DPRK IT workers) and tunneling through multiple European IPs before landing on residential US IP addresses via remote desktop tools.

7. What signs exposed the deepfake attempt?

Despite the use of real-time filters, the executions were described as clumsy and a poor impersonation. Inconsistencies included an unnaturally smoothed face, a mouth that barely moved while speaking, teeth failing to match lip motion, and a lack of ability to respond to a simple question posed in Spanish, even though they claimed to be Mexican engineers.

8. What immediate action did the threat actors take after the interviews?

Following the termination of the interviews, the operators immediately deleted their online profiles, such as their LinkedIn pages, which is a classic pattern of a Chollima infiltration attempt.

9. What are the substantial risks companies face due to this type of remote hiring fraud?

Companies face substantial financial and legal risks. For context, North Korean hackers have been reported to steal more than $88 million through similar impersonation tactics.

10. What Should CISOs and SOC Analysts Do Next?

1. Monitor VPN traffic from residential IPs.
2. Detect sudden new account creations tied to hiring pipelines.
3. Correlate anomalies in identity providers and remote access logs.

Organizations must apply rigorous background checks, verify official national IDs, and document interviews to establish candidate authenticity. Efforts should also focus on minimizing the amount and sensitivity of data available to external parties. Training users to be aware of impersonation tricks, such as confirming requests through independent platforms, is also vital.

Tactical Overview (TTPs)

The Chollima Synthetic Interview Operation relies on a chain of sophisticated behaviors aligned with established MITRE ATT&CK tactics.