One Recruiter, Two Countries: Tracking a DPRK-Aligned Fake Hiring Persona with OSINT
A technical talk on the investigation behind a fake recruiter persona targeting developers with crypto access — and how open-source intelligence exposes campaigns like it.
About
I'm a cybercrime consultant based in Bengaluru, working on the parts of the internet that are easiest to get wrong — scam infrastructure, fraudulent personas, and the trail they leave behind. Most of my work is open-source intelligence: investigating cybercrime, triaging incidents for individuals and startups, and working out whether the thing in front of someone is real.
Writing is the other half of it. I publish long-form infosec notes on Medium, because complex ideas are worth the effort of making them readable.
Away from the terminal I volunteer with BSides Bangalore as a core team member, follow politics closely, and keep programming around as a hobby rather than only a job.
What I do
🕵️OSINT investigations
Tracing scams, fraudulent personas and malicious campaigns back to the infrastructure behind them.
🚨Cybercrime triage
Helping individuals and startups work out what hit them, what was exposed, and what to do in the next hour.
🔍Legitimacy assessment
Verifying recruiters, companies, domains and offers that feel wrong — before anyone clicks or signs.
👣Digital forensics
Evidence, artefacts and incident trails, handled so the findings hold up when they matter.
Experience
- Oct 2024 — Present
Cybercrime Consultant
Cyber Secify Consulting · Bengaluru - Aug 2026 — Present
Founding Member & Treasurer
CopConnect Karnataka · Bengaluru - Jul 2022 — Present
Core Team Member
Security BSides Bangalore - Jul 2022 — Present
Information Security Blogger
Medium · Self-employed - Feb 2022 — Present
Cybersecurity Consultant
Self-employed - Dec 2022 — Apr 2024
Project Management
Cloud Security Alliance, Bangalore Chapter - Jun 2022 — Feb 2023
Cybersecurity & Chapter Operations — Internship
Cloud Security Alliance, Bangalore Chapter
Credentials
Certifications
- CCIO — Certified Cyber Crime Intervention Officer
- CHFI — Computer Hacking Forensic Investigator
- CEH
- CND
- ECSA
- CSCU
- CPEW
Education
- BE in Computer Science & Engineering — North East Frontier Technical University, 2022
Investigation & intelligence
- OSINT tradecraft
- Threat intelligence
- Attribution
- Fraud analysis
- Malware triage
- Phishing analysis
- Log analysis
Platforms & tooling
- Splunk
- Azure Sentinel
- Exabeam XDR
- Carbon Black
- SentinelOne
- Microsoft 365 Defender
- Proofpoint
- Forcepoint DLP
- Deepwatch
- Red Canary
- Rapid7 Nexpose
- Cloudflare WAF
- Palo Alto NGFW
- DUO MFA
- ServiceNow
Built with
Writing auto-updated
- Overview of Top Mobile Security Threats in 2023Dec 2023
- The Security Myth: Unravelling Misconceptions in Today’s Digital LandscapeDec 2023
- OSINT Framework: Collections of Open Source Intelligence ToolsetsJul 2023
- Overview of Top Mobile Security Threats in 2022Jun 2022
- Raspberry Pi Network Vulnerability Scanner OpenVas!May 2022
- Tools For Linux System AdministratorMar 2022
Projects live from GitHub
cloudflare-origin-ip
Finds the true origin IP of a web application behind Cloudflare by scoring HTTP response similarity across candidate addresses with the Levenshtein algorithm.
SecScraper
Scraping utility built for security research and intelligence-gathering workflows.
Keylogger
A deliberately minimal Linux keylogger in Node.js, written with no external modules — using events and fs.createReadStream rather than fs.open.
Detecting-Vehicle-and-speed
Computer-vision program that detects vehicles in video and estimates their speed.
Get in touch
Not sure whether that recruiter, offer or company is real? Send it to me. I'll verify it and tell you what I find — no charge, no judgment.
I also work with individuals and startups on cybercrime triage, scam investigation and digital fraud analysis.