Inside the Machine: A Public Technical Investigation of Lazarus-Attributed Contagious Interview Infrastructure, 2024–2026

Abstract

This public technical research article reconstructs a Lazarus-attributed fake-interview ecosystem targeting software developers, Web3 engineers, and cryptocurrency-adjacent organizations between 2024 and 2026. The investigation began after a fake technical interview reached Red Asgard in December 2025. The article documents the resulting investigation into malicious repositories, command-and-control panels, FTP and HTTP exfiltration, fake cryptocurrency exchanges, cryptomining infrastructure, operator-side development systems, blockchain-intelligence exposure, and related monetization tracks. The public version includes aggregate victimology, infrastructure reconstruction, malware and protocol analysis, counting methodology, attribution framework, public-safe indicators, detection logic, and defensive guidance. The public version deliberately excludes plaintext credentials, victim identifiers, private keys, session tokens, replayable C2 access mechanics, operator personal identifying information not cleared for release, and specific named unnotified victims. Restricted evidence packages are retained for vetted law-enforcement, CERT, provider, counsel-controlled, and affected-party disclosure channels. Original public article: https://redasgard.com/research/inside-the-machine