Louis Hur
Stealthmole, Senior tech leader
Actions
Louis Hur is a cybersecurity researcher and practitioner focused on state-sponsored cybercrime, financial-sector threats, and advanced threat intelligence. He has presented at international security conferences including Black Hat, HITB, HITCON, and ISEC, covering nation-state cyber operations, cyber-enabled financial crime, and underground threat infrastructure.
His work spans deep and dark web intelligence, cryptocurrency abuse investigations, insider-driven attack models, and DPRK-linked financial cyber operations. Louis combines technical analysis with HUMINT-based insights, including interviews with former DPRK IT personnel, to understand how state-sponsored financial cybercrime operates beyond malware, indicators, and blockchain transactions.
He works with financial institutions, regulators, and law enforcement agencies across Asia and the Middle East to support prevention, detection, and disruption efforts against large-scale cyber-enabled financial crime. Louis is currently based in Singapore.
Links
Following DPRK’s Revenue Trail: Hunting Fake IT Workers, Crypto Theft, and Laundering Infra
North Korea-linked financial cyber operations are no longer just “big crypto hacks.” They now look more like a revenue machine: fake remote IT workers, crypto-platform compromise, scam infrastructure, laundering support, AI-assisted identity work, and repeated operational mistakes across accounts, devices, and communication channels.
This talk follows that revenue trail from an investigator’s point of view. Based on sanitized 2024–2025 case patterns, public reporting, dark and deep web intelligence, OSINT, infostealer-derived artifacts, and Korean-language HUMINT, I will show how DPRK-linked operators can be investigated when malware samples and wallet tracing are not enough.
The session begins with a recent crypto-platform compromise where public analysis produced only a small number of useful indicators. From there, we move into persona infrastructure: fake developer profiles, reused communication accounts, browser and translation artifacts, remote-access traces, recruitment activity, Telegram exposure, and AI-generated identity material.
The second half focuses on fraudulent remote IT workers and laundering workflows. I will walk through how job-seeking behavior, work-platform activity, salary discussions, emergency excuses, VPN/RDP usage, cloud apps, and messaging records can become evidence in a cybercrime investigation.
Attendees will leave with a practical hunting model for connecting crypto theft, fake employment, identity artifacts, infrastructure reuse, and laundering behavior into one investigation workflow.
DefCamp 2026 Sessionize Event Upcoming
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top