North Korea-linked financial cyber operations are no longer just “big crypto hacks.” They now look more like a revenue machine: fake remote IT workers, crypto-platform compromise, scam infrastructure, laundering support, AI-assisted identity work, and repeated operational mistakes across accounts, devices, and communication channels.

This talk follows that revenue trail from an investigator’s point of view. Based on sanitized 2024–2025 case patterns, public reporting, dark and deep web intelligence, OSINT, infostealer-derived artifacts, and Korean-language HUMINT, I will show how DPRK-linked operators can be investigated when malware samples and wallet tracing are not enough.

The session begins with a recent crypto-platform compromise where public analysis produced only a small number of useful indicators. From there, we move into persona infrastructure: fake developer profiles, reused communication accounts, browser and translation artifacts, remote-access traces, recruitment activity, Telegram exposure, and AI-generated identity material.

The second half focuses on fraudulent remote IT workers and laundering workflows. I will walk through how job-seeking behavior, work-platform activity, salary discussions, emergency excuses, VPN/RDP usage, cloud apps, and messaging records can become evidence in a cybercrime investigation.

Attendees will leave with a practical hunting model for connecting crypto theft, fake employment, identity artifacts, infrastructure reuse, and laundering behavior into one investigation workflow.