DPRK Fake IT Worker Scheme: FBI Raids Texas Laptop Farms — Detection and Defense Guide for Hiring Orgs

This week the Justice Department announced coordinated enforcement actions against North Korea's long-running scheme to embed fraudulent IT workers inside American companies. The FBI executed searches at roughly 40 homes across Texas, two US nationals were arrested, and 14 individuals were charged in connection with an operation that used stolen US identities to place DPRK nationals into remote IT roles at approximately 70 US companies — generating an estimated $3 million in wages funneled back to the Pyongyang regime.

This is not a vulnerability story. There is no CVE, no patch, and no vendor advisory coming. This is an identity-and-access integrity failure — a state adversary systematically defeating US hiring pipelines, payroll verification, and remote-work trust models. Every organization that hires remote technical talent is in scope, and the FBI and CISA have been warning about exactly this pattern since the 2022 joint advisory and the 2023–2024 updates. The Texas raids show the scheme is not shrinking; it is industrialized, with US-based facilitators running "laptop farms" that host company-issued hardware stateside while the actual operator sits in North Korea or a third country.

If your SOC, HR, and procurement teams are not treating remote worker identity assurance as a security control, you have an unmonitored attack surface with a nation-state adversary already mapped to it.

Technical Analysis: How the DPRK IT Worker Operation Works

The Attack Chain (Defender's View)

This campaign maps cleanly to MITRE ATT&CK as a blended social-engineering and insider-access operation:

1. Identity acquisition (T1583 / T1078): DPRK operators purchase or steal US identities — real SSNs, names, and addresses belonging to real Americans — to pass employment eligibility checks (I-9, E-Verify) and background screens. Stolen identity data is often sourced from prior breach dumps or purchased via facilitators.
2. Application and interview fraud: Candidates apply for remote software development, QA, DevOps, and IT support roles — frequently through freelance platforms and staffing agencies that minimize in-person verification. AI-assisted deepfake video and voice, scripted interview answers, and proxy interview takers are used to pass live screening.
3. The laptop farm (T1105 / T1219): The company ships a corporate laptop to the stolen identity's US address — which is actually a facilitator's home (the 40 Texas residences raided). The facilitator keeps the device powered on, connected to US residential broadband, and installs remote access software so the DPRK operator can control it. To the employer's telemetry, the worker is a domestic US employee on a residential IP. In reality, keystrokes originate overseas.
4. Revenue and secondary objectives (T1486-adjacent, espionage): Wages are laundered through US bank accounts held by facilitators, converted, and repatriated to fund DPRK weapons programs. Beyond wages, these embedded workers gain legitimate privileged access — source code repositories, CI/CD pipelines, cloud credentials, customer data. Several documented cases escalated to extortion and data theft after termination, where dismissed fake workers threatened to leak proprietary code.

What Makes This Hard to See

• All telemetry looks domestic. VPN, MDM, and IdP logs show US residential IPs because the hardware genuinely is in Texas.
• The identity is real. E-Verify passes because the SSN and name belong to a real, consenting (or compromised) US person.
• The worker performs. Many DPRK operators are competent developers delivering actual work — there is no "malicious behavior" tripwire in the traditional sense.
• The abuse lives in the gaps between HR, IT, and security. Onboarding fraud is nobody's dashboard.

Exploitation Status

This is confirmed, active, industrial-scale nation-state activity — DOJ indictments and FBI search warrants across 40 locations are the opposite of theoretical. The FBI's public guidance and prior DOJ actions (including the Arizona laptop farm case and multiple 2024–2025 indictments) confirm this is a sustained campaign, and the Texas operation is the latest node, not the last.

Detection & Response

The highest-signal detections target the remote-control layer and behavioral anomalies — not the identity itself, which passes conventional checks.

Sigma Rules

---
title: Unauthorized Remote Access Tool Installed on Corporate Endpoint
tid: 3f8a2c11-9b4d-4e7a-b2c6-5d1e0f9a8b7c
status: experimental
description: Detects installation or execution of consumer remote access tools (AnyDesk, TeamViewer, RustDesk, Splashtop, Chrome Remote Desktop) commonly used by DPRK IT worker facilitators to operate company laptops from overseas laptop farms.
references:
  - https://www.ic3.gov/PSA/2024/PSA240116
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\rustdesk.exe'
      - '\SplashTop\Streamer.exe'
      - '\remoting_host.exe'
      - '\lmlw.exe'
      - '\Parsec.exe'
      - '\screenconnect.client.exe'
  filter_approved:
    CommandLine|contains:
      - 'approved-rmm-deployment-switch'
  condition: selection and not filter_approved
falsepositives:
  - Organizations with sanctioned RMM tooling — maintain an explicit allowlist and tune the filter
level: high
---
title: Corporate Endpoint Connected to Residential IP With Sustained Remote Session
tid: 8e4d1f72-6a3b-4c9d-a1e5-2f7b0c4d9e6a
status: experimental
description: Detects outbound network connections to known consumer remote-access infrastructure, a hallmark of laptop-farm operations where the physical device is controlled by an overseas operator.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://securityaffairs.com/201193/intelligence/north-korean-it-workers-used-stolen-us-identities-to-earn-3-million.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'anydesk.com'
      - 'teamviewer.com'
      - 'rustdesk.com'
      - 'splashtop.com'
      - 'parsec.app'
      - 'screenconnect.com'
  filter_workstations:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
  condition: selection and not filter_workstations
falsepositives:
  - Web browsing to vendor sites is filtered; process-level connections from RMM binaries are the signal
level: medium
---
title: USB KVM or HID Injection Device Activity on Employee Endpoint
tid: 5c2b9e41-7d6f-4a8c-b3e2-1a0d8f6c4b9e
status: experimental
description: Detects registry artifacts of USB KVM-over-IP and HID emulation devices (PiKVM, TinyPilot, JetKVM) used in laptop farms to give remote operators hardware-level control while appearing as a local keyboard/mouse.
references:
  - https://attack.mitre.org/techniques/T1200/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1200
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'Enum\USB\VID_1D6B' # Linux Foundation / PiKVM composite gadget
      - 'Enum\USB\VID_3346' # TinyPilot
    TargetObject|contains:
      - 'PiKVM'
      - 'TinyPilot'
      - 'JetKVM'
falsepositives:
  - Rare in standard corporate environments; validate any hit against known developer hardware labs
level: high

KQL — Microsoft Sentinel / Defender

This hunt targets the combination that actually exposes laptop farms: RMM tooling on endpoints, impossible-work-hour session patterns, and sign-in/device geography mismatches. Run it across process, network, and identity telemetry.

// Hunt 1: Remote access tooling on corporate endpoints
let RMM_Processes = dynamic(["AnyDesk.exe","TeamViewer.exe","TeamViewer_Service.exe","rustdesk.exe","remoting_host.exe","Parsec.exe","screenconnect.client.exe","Splashtop_Streamer.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ (RMM_Processes)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 10) by DeviceName, FileName, InitiatingProcessAccountName
| order by FirstSeen asc;

// Hunt 2: Active hours analysis — sustained sessions during US overnight hours (operator overseas)
DeviceLogonEvents
| where TimeGenerated > ago(30d)
| extend HourUTC = datetime_part("hour", TimeGenerated)
| summarize OvernightActivity=countif(HourUTC >= 2 and HourUTC <= 11), TotalActivity=count() by DeviceName, AccountName, bin(TimeGenerated, 1d)
| where TotalActivity > 0
| extend OvernightRatio = todouble(OvernightActivity) / TotalActivity
| where OvernightRatio > 0.7
| order by OvernightRatio desc;

// Hunt 3: IdP sign-ins from residential IPs inconsistent with HR-record employee location
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| summarize Locations=make_set(LocationDetails.city), ISPs=make_set(NetworkLocationDetails.networkNames), IPCount=dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1d)
| where array_length(ISPs) > 1
| order by IPCount desc;

Velociraptor VQL

Deploy as a hunt across your managed fleet to surface unauthorized remote-control software and its active sessions — the definitive laptop-farm artifact.

-- DPRK laptop farm hunt: unauthorized RMM processes and their live connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|parsec|remoting_host|screenconnect)'

-- Correlate with established connections from those same processes
SELECT Pid, Name, Family, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|parsec|remoting_host|screenconnect)'
  AND Status =~ 'ESTAB'

-- Persistence check: RMM services registered for autostart
SELECT Name, DisplayName, PathName, StartMode, State
FROM wmi(query='SELECT Name, DisplayName, PathName, StartMode, State FROM Win32_Service')
WHERE PathName =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|parsec|screenconnect)'

Remediation / Audit Script

Run this PowerShell audit across your remote-worker fleet (via your RMM/MDM of choice) to inventory unauthorized remote-access tooling, enumerate suspicious autostart entries, and check for USB KVM artifacts.

# Audit endpoints for unauthorized remote access tooling (laptop farm indicators)
$RMMNames = 'anydesk','teamviewer','rustdesk','splashtop','parsec','screenconnect','remoting_host'
$Report = @()

# 1. Installed software check
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $_.DisplayName -match ($RMMNames -join '|') }
foreach ($app in $installed) {
  $Report += [PSCustomObject]@{Type='InstalledRMM'; Name=$app.DisplayName; Detail=$app.InstallLocation}
}

# 2. Running processes and services
Get-Process | Where-Object { $_.Name -match ($RMMNames -join '|') } | ForEach-Object {
  $Report += [PSCustomObject]@{Type='RunningProcess'; Name=$_.Name; Detail=$_.Path}
}
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match ($RMMNames -join '|') } | ForEach-Object {
  $Report += [PSCustomObject]@{Type='Service'; Name=$_.Name; Detail="$($_.State) - $($_.PathName)"}
}

# 3. USB KVM / HID emulation artifacts (PiKVM, TinyPilot)
Get-PnpDevice -Class USB -ErrorAction SilentlyContinue |
  Where-Object { $_.FriendlyName -match 'PiKVM|TinyPilot|JetKVM' } | ForEach-Object {
  $Report += [PSCustomObject]@{Type='USBKVM'; Name=$_.FriendlyName; Detail=$_.InstanceId}
}

# 4. Long-lived outbound sessions to RMM infrastructure
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -in 5938,6568,443,80 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Name -match ($RMMNames -join '|')) {
      $Report += [PSCustomObject]@{Type='LiveSession'; Name=$proc.Name; Detail="$($_.RemoteAddress):$($_.RemotePort)"}
    }
  }

if ($Report.Count -gt 0) {
  Write-Warning "Potential unauthorized remote-access artifacts found on $env:COMPUTERNAME"
  $Report | Format-Table -AutoSize
  $Report | Export-Csv "$env:TEMP\rmm_audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
} else {
  Write-Output "No unauthorized RMM artifacts detected on $env:COMPUTERNAME"
}

Remediation: Hardening the Hiring and Remote-Work Pipeline

Because there is no patch, remediation is a program-level control set spanning HR, IT, and security. Prioritize these:

1. Identity verification hardening (highest ROI):
   • Require live, unscripted video verification during onboarding — ask candidates to perform spontaneous actions (hold up a physical ID next to their face, turn their head, answer ad-hoc questions) to defeat deepfake and proxy interviews.
   • Cross-reference the hire's SSN against IRS/Social Security Administration mismatch notices; treat SSA no-match letters as security incidents, not HR paperwork.
   • Validate that the person's digital footprint (LinkedIn history, GitHub contributions, prior employers) is internally consistent and verifiable via direct contact with listed references at published corporate numbers — never numbers the candidate supplies.
2. Device delivery controls: Ship company hardware only after identity verification completes, and require a live video unboxing/activation call. Flag addresses that are freight forwarders, commercial mail receiving agencies, or addresses shared by multiple "employees." Geofence expected device location at provisioning.
3. RMM allowlisting and blocking: Maintain an explicit approved-tools list; block execution and network egress for all other consumer remote-access tools via AppLocker/WDAC and proxy policy. This is the single most effective technical tripwire against laptop farms.
4. Continuous behavioral monitoring: Alert on sustained overnight activity inconsistent with the employee's stated timezone, hardware located far from the HR-record address (MDM geolocation), and sign-ins from residential ISPs that change frequently.
5. Offboarding and incident response integration: When a fraudulent worker is identified, treat it as a full incident: assume code repository, credential, and customer data exposure; rotate all secrets the account touched; review commit history for anomalous access; preserve the endpoint as evidence. Coordinate with the FBI via your local field office or ic3.gov before confronting or terminating, per FBI guidance — premature termination forfeits investigative value and has triggered retaliatory extortion in documented cases.
6. Leverage official guidance: Implement the controls in the FBI/CISA/State Department advisories on DPRK IT workers (see ic3.gov public service announcements and the Treasury/State/FBI joint guidance), which include red-flag indicators for hiring teams and are updated as the scheme evolves.

The Texas raids dismantled one node of this operation. The scheme itself — 70 companies, $3 million in this indictment alone, and thousands of attempted placements annually per FBI estimates — will reconstitute. Organizations that treat remote-worker identity assurance as a SOC-monitored control, not an HR formality, are the ones that will catch the next laptop farm before it becomes a line item in an indictment.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub