Inside the Machine

A Lazarus-attributed fake-interview ecosystem reconstructed across May 2025 – April 2026. Final telemetry confirms 14,716+ victim records across 74 countries, an infrastructure footprint of 53,941 IPs and 375,989 domains, $204M+ in stolen cryptocurrency traced to seven wallet clusters prepared for sanctions referral, and a 1.4 TB breach of the CENTIC.io blockchain intelligence platform.

The investigation did not begin as a research project. Red Asgard was targeted through the same fake-interview machinery documented throughout the article – that targeting is the origin. Findings independently converge with intelligence from Palo Alto Networks Unit 42, Group-IB, Kaspersky, ESET, Cisco Talos, NTT Security, JPCERT/CC, and Mandiant.

The article covers technical architecture, malware families (BeaverTail, OtterCookie, InvisibleFerret, the npoint fork), aggregate victimology, financial tracing methodology, and defensive guidance derived from the investigation. The full PDF is the canonical artifact; this page is the entry point.