For the past several years, the security community has tracked the DPRK IT worker scheme: North Korean nationals posing as remote IT professionals, using stolen or fabricated identities to obtain employment at Western companies, and funneling wages back to the regime's weapons programs. That threat model just changed. Recent investigations have identified suspected DPRK-linked workers embedded outside the IT function entirely — in sales and marketing roles and in the medical profession.
If your detection strategy was scoped to "suspicious remote developers," it is now officially out of date. A fraudulent worker in a sales role has legitimate access to your CRM, customer PII, and pricing intelligence. A fraudulent worker in a healthcare context sits adjacent to PHI, e-prescribing systems, and billing infrastructure. The revenue-generation objective remains the same, but the blast radius and the compliance exposure (HIPAA, PCI-DSS, state privacy laws) grow substantially.
This post breaks down how the scheme operates in 2026, what your SOC can actually observe, and the hiring and access controls that materially reduce your risk.
Technical Analysis: How the Scheme Works
The Operating Model
The DPRK worker scheme is not a malware problem — it is an identity, access, and logistics problem. The observable components have been consistent across FBI, State Department, and private-sector reporting:
- Identity fabrication and theft. Workers use stolen U.S. identities, fabricated personas, AI-generated or heavily edited headshots, and front companies to pass background checks. In some cases, U.S.-based facilitators run "laptop farms" — racks of company-issued laptops physically located in the United States so that geolocation and device checks pass.
- Remote access and KVM tooling. Workers located overseas (frequently operating through China or Russia) connect into U.S.-based laptops using commercial remote access tooling — AnyDesk, TeamViewer, Chrome Remote Desktop, RustDesk, Splashtop — or KVM-over-IP hardware attached to the corporate device. From the employer's EDR perspective, the laptop is in Ohio. The hands on the keyboard are not.
- VPN and proxy layering. Login traffic is routed through residential proxies and VPN exit nodes to match the claimed location. Authentication telemetry alone is rarely sufficient to catch this.
- Day-job obfuscation. Workers frequently hold multiple simultaneous jobs, use mouse-jigglers and automation to appear active, and subcontract the actual work to other DPRK personnel.
Why the Expansion Into Healthcare and Sales Matters
The move beyond IT is a rational adversary adaptation. IT hiring pipelines have become heavily scrutinized — enhanced identity verification, in-person requirements, and security awareness specifically targeting this scheme. Sales, marketing, and clinical-adjacent roles have not caught up:
- Sales and marketing: These roles are remote-friendly, high-turnover, and frequently hired with minimal technical vetting. Access includes CRM data, customer lists, contracts, and sometimes marketing automation credentials with cloud API keys embedded.
- Medical profession: Healthcare organizations are chronically understaffed, rely on locum tenens and telehealth staffing agencies, and often extend access to EHR-adjacent systems, billing platforms, and e-prescribing portals to contractors with limited identity assurance. The combination of staffing pressure and HIPAA-regulated data is exactly the kind of gap a state-sponsored revenue operation exploits.
Exploitation Status
This is confirmed, ongoing, and actively expanding — not theoretical. U.S. government advisories (FBI, State, Treasury) have documented the IT worker scheme for years, with indictments of U.S.-based facilitators operating laptop farms. The 2026 reporting on sector expansion indicates the operation is diversifying in response to increased scrutiny of IT hiring pipelines. There is no associated CVE — the vulnerability being exploited is your hiring and identity verification process.
Detection & Response
Detection for this threat rests on three pillars: (1) unauthorized remote access tooling on endpoints, (2) impossible or anomalous identity/access telemetry, and (3) device artifacts consistent with laptop-farm or KVM setups. The rules and queries below are tuned for low noise — they target commercial RMM tooling that, in most mature environments, has a defined allowlist. Baseline your approved tools first; anything outside that allowlist running on an employee endpoint is worth a conversation.
SIGMA Rules
---
title: Execution of Unauthorized Remote Access Tool on Corporate Endpoint
id: 3f8c2a14-9b6d-4e71-a523-7d1f0c9e4b28
status: experimental
description: Detects execution of commercial remote access tools commonly abused by DPRK IT worker schemes to proxy overseas operators into U.S.-based corporate devices. Tune against your organization's approved RMM allowlist.
references:
- https://thehackernews.com/2026/08/north-korean-job-fraud-expands-beyond.html
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\AnyDesk.exe'
- '\TeamViewer.exe'
- '\TeamViewer_Service.exe'
- '\rustdesk.exe'
- '\rustdesk-server.exe'
- '\Splashtop.exe'
- '\SRManager.exe'
- '\chrome_remote_desktop_host.exe'
- '\remoting_host.exe'
- '\AmmyyAdmin.exe'
- '\ScreenConnect.ClientService.exe'
- '\dwagent.exe'
filter_approved_paths:
Image|startswith:
- 'C:\Program Files\YourApprovedRMM\'
condition: selection_img and not filter_approved_paths
falsepositives:
- Approved RMM tooling installed by IT — maintain an allowlist and update the filter
- VDI/broker environments where remoting hosts are expected
level: high
---
title: Remote Access Tool Persisted as Service or Run Key
id: 8e1d4f62-3a97-4c5b-b846-2f9a1d7e6c30
status: experimental
description: Detects persistence of remote access tooling via Windows services or Run keys, consistent with laptop-farm operations where overseas operators require survivable access to the corporate device.
references:
- https://thehackernews.com/2026/08/north-korean-job-fraud-expands-beyond.html
- https://attack.mitre.org/techniques/T1543/003/
- https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.persistence
- attack.t1543.003
- attack.t1219
logsource:
category: registry_set
product: windows
detection:
selection_service:
TargetObject|contains:
- '\Services\AnyDesk\ImagePath'
- '\Services\TeamViewer\ImagePath'
- '\Services\rustdesk\ImagePath'
- '\Services\SplashtopRemoteService\ImagePath'
- '\Services\chromoting\ImagePath'
selection_runkey:
TargetObject|contains:
- '\CurrentVersion\Run\AnyDesk'
- '\CurrentVersion\Run\TeamViewer'
- '\CurrentVersion\Run\rustdesk'
- '\CurrentVersion\Run\ChromeRemoteDesktop'
condition: 1 of selection_*
falsepositives:
- Legitimate IT-managed RMM deployments
level: high
---
title: Endpoint Network Connection to Remote Access Tool Infrastructure
id: b47c9e01-5d23-4f8a-9c61-3e7b2a0f5d94
status: experimental
description: Detects outbound connections to known RMM service domains from corporate endpoints, useful for catching RMM tooling that is renamed or packed to evade filename-based detection.
references:
- https://thehackernews.com/2026/08/north-korean-job-fraud-expands-beyond.html
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: network_connection
product: windows
detection:
selection_domain:
DestinationHostname|contains:
- '.anydesk.com'
- '.teamviewer.com'
- 'rustdesk.com'
- '.splashtop.com'
- '.splashtop.eu'
- 'remotedesktop.google.com'
- '.screenconnect.com'
filter_approved:
Image|endswith:
- '\YourApprovedRMMAgent.exe'
condition: selection_domain and not filter_approved
falsepositives:
- Vendor support sessions initiated by legitimate users — correlate with helpdesk tickets
level: medium
KQL Hunting (Microsoft Sentinel / Defender)
This query hunts for process execution of unauthorized RMM tools joined against sign-in telemetry anomalies — specifically, accounts authenticating to Entra ID from a geography that doesn't match the endpoint's physical presence. The RMM component is the high-fidelity signal; the identity pivot provides the correlation layer that catches laptop-farm scenarios.
// Define your approved RMM toolset — anything outside this list is investigative surface
let ApprovedRMM = dynamic(["YourApprovedRMMAgent.exe", "Microsoft Quick Assist"]);
let RMMProcessEvents =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (
"AnyDesk.exe", "TeamViewer.exe", "TeamViewer_Service.exe", "rustdesk.exe",
"Splashtop.exe", "SRManager.exe", "remoting_host.exe", "AmmyyAdmin.exe",
"ScreenConnect.ClientService.exe", "dwagent.exe"
)
| where not(FileName in~ (ApprovedRMM))
| project RMMTime=TimeGenerated, DeviceId, DeviceName, FileName, ProcessCommandLine,
InitiatingProcessAccountName, InitiatingProcessAccountUpn, ReportId;
RMMProcessEvents
| join kind=leftouter (
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| summarize arg_min(TimeGenerated, *) by UserPrincipalName, bin(TimeGenerated, 1h)
| project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, Location,
AppDisplayName, DeviceDetail
) on $left.InitiatingProcessAccountUpn == $right.UserPrincipalName
| extend SigninGeoRisk = iif(
Location in~ ("CN", "RU", "KP", "IR") or isempty(Location), "Review", "OK")
| project RMMTime, DeviceName, FileName, ProcessCommandLine,
InitiatingProcessAccountUpn, IPAddress, Location, SigninGeoRisk, ReportId
| order by RMMTime desc
A complementary query for environments ingesting Syslog from remote-access or VDI gateways, catching authentication source IP churn characteristic of residential-proxy hopping:
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "authpriv" or ProcessName =~ "sshd"
| where SyslogMessage has "Accepted"
| extend SourceIP = extract(@"from ([0-9\.]+)", 1, SyslogMessage)
| summarize DistinctIPs = dcount(SourceIP), IPs = make_set(SourceIP)
by Computer, bin(TimeGenerated, 1d)
| where DistinctIPs > 5
| order by DistinctIPs desc
Velociraptor VQL
This artifact triages a suspect endpoint for the three artifacts that matter most in a suspected DPRK worker scenario: running RMM processes, active outbound connections to RMM infrastructure, and evidence of KVM/USB redirection devices. Run it as a hunt across your remote-worker fleet or scope it to a single subject's device during an investigation.
-- Triage: RMM tooling, RMM network connections, and KVM-style device artifacts
-- relevant to DPRK IT worker / laptop-farm investigations
LET rmm_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|remoting_host|ammyy|screenconnect|dwagent)'
LET rmm_conns = SELECT Pid, Name, Path, Status,
Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
AND Name =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|remoting|screenconnect)'
LET service_persist = SELECT Name, DisplayName, PathName, StartName
FROM SELECT * FROM wmi(
query="SELECT Name, DisplayName, PathName, StartName FROM Win32_Service",
namespace="root/cimv2")
WHERE PathName =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|chromoting|screenconnect)'
SELECT 'process' AS ArtifactType, Pid, Name, Exe AS Detail, CommandLine AS Extra1, Username AS Extra2
FROM rmm_procs
UNION ALL
SELECT 'network' AS ArtifactType, Pid, Name, RemoteIP AS Detail,
format('%v', RemotePort) AS Extra1, Status AS Extra2
FROM rmm_conns
UNION ALL
SELECT 'service_persistence' AS ArtifactType, 0 AS Pid, Name,
PathName AS Detail, DisplayName AS Extra1, StartName AS Extra2
FROM service_persist
Remediation Script
The script below audits a Windows endpoint for unauthorized RMM installations, running services, persistence entries, and (optionally) removes unauthorized tooling. Deploy it via your RMM-of-record or Intune as a remediation script. Review the allowlist before running with -Remove in production.
#Requires -RunAsAdministrator
# DPRK Insider Threat: Unauthorized RMM Audit & Removal
# Usage: .\Invoke-UnauthorizedRMMAudit.ps1 -> audit only (report)
# .\Invoke-UnauthorizedRMMAudit.ps1 -Remove -> stop processes, disable services, flag for uninstall
param(
[switch]$Remove
)
# --- EDIT: your organization's approved remote access tooling ---
$ApprovedRMM = @('YourApprovedRMMAgent', 'quickassist')
$RMMSignatures = @(
'AnyDesk', 'TeamViewer', 'rustdesk', 'Splashtop',
'remoting_host', 'chromoting', 'Ammyy', 'ScreenConnect',
'dwagent', 'dwrcs', 'ultraviewer', 'gotomypc'
)
$findings = [System.Collections.Generic.List[object]]::new()
# 1) Running processes matching unauthorized RMM signatures
Get-Process | Where-Object {
$p = $_.ProcessName
($RMMSignatures | Where-Object { $p -like "*$_*" }) -and
-not ($ApprovedRMM | Where-Object { $p -like "*$_*" })
} | ForEach-Object {
$findings.Add([pscustomobject]@{
Type='Process'; Name=$_.ProcessName; Path=$_.Path; Id=$_.Id
})
if ($Remove) { Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue }
}
# 2) Services with unauthorized RMM binaries
Get-CimInstance Win32_Service | Where-Object {
$path = $_.PathName
($RMMSignatures | Where-Object { $path -like "*$_*" }) -and
-not ($ApprovedRMM | Where-Object { $path -like "*$_*" })
} | ForEach-Object {
$findings.Add([pscustomobject]@{
Type='Service'; Name=$_.Name; Path=$_.PathName; Id=''
})
if ($Remove) {
Stop-Service -Name $_.Name -Force -ErrorAction SilentlyContinue
Set-Service -Name $_.Name -StartupType Disabled -ErrorAction SilentlyContinue
}
}
# 3) Run-key persistence entries
$runKeys = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
if (Test-Path $key) {
(Get-ItemProperty $key).PSObject.Properties | Where-Object {
$v = "$($_.Value)"
($RMMSignatures | Where-Object { $v -like "*$_*" }) -and
-not ($ApprovedRMM | Where-Object { $v -like "*$_*" })
} | ForEach-Object {
$findings.Add([pscustomobject]@{
Type='RunKey'; Name=$_.Name; Path=$_.Value; Id=$key
})
if ($Remove) {
Remove-ItemProperty -Path $key -Name $_.Name -ErrorAction SilentlyContinue
}
}
}
}
# 4) Report
if ($findings.Count -eq 0) {
Write-Output "[CLEAN] No unauthorized remote access tooling detected."
} else {
Write-Output "[ALERT] $($findings.Count) finding(s) — escalate to IR with device, user, and HR records:"
$findings | Format-Table -AutoSize
# Ship to SIEM: Write-EventLog -LogName Application -Source 'RMM-Audit' -EventId 9001 -EntryType Warning -Message ($findings | ConvertTo-Json -Compress)
}
Remediation: Closing the Hiring-to-Access Gap
There is no patch for this threat. Remediation is a cross-functional control problem spanning HR, IT, security, and legal. Prioritize in this order:
1. Identity verification at hiring (highest leverage, lowest cost)
- Require live, camera-on identity verification against government-issued ID for all remote roles — not just engineering. Compare against the interview footage; DPRK workers routinely swap personas between interview rounds or use deepfaked video. Watch for poor lip-sync, refusal to turn cameras on, and "technical issues" during verification steps.
- Use a liveness-verified identity proofing service (e.g., IAL2-compliant proofing aligned to NIST SP 800-63) rather than document-image upload, which is trivially defeated with stolen identities.
- Treat staffing agencies and locum tenens providers as a supply-chain risk: contractually require proof of their identity verification controls for healthcare placements, and audit a sample.
- Flag hiring-process anomalies for security review: requests to ship equipment to addresses different from the application, name changes between offer and onboarding, refusal of in-person onboarding, and mismatched social media history.
2. Device and shipping controls
- Ship laptops only to verified residential addresses matching background check results. Hold equipment shipments flagged to reshippers, freight forwarders, or addresses associated with known laptop-farm indictments.
- Enroll all devices in MDM with geolocation and attestation enabled. Alert on device location diverging from the employee's claimed location, and on device management certificates being tampered with.
3. Access and session controls
- Enforce conditional access policies binding authentication to compliant, organization-managed devices with geolocation signals. A user whose Entra sign-in resolves to a residential proxy ASN while their device phones home from suburban Ohio is your detection.
- Block unauthorized RMM tooling by policy (AppLocker/WDAC on Windows, and application allowlisting on macOS). Commercial remote access software should be an IT-provisioned exception, not a user installable.
- Apply least privilege by role. A sales hire does not need CRM bulk-export on day one; a clinical contractor does not need PHI access outside their patient panel. The DPRK scheme monetizes access breadth — narrow it.
4. When you identify a suspected worker
- Do not tip off the subject. Involve legal counsel immediately — this is a federal investigation matter (sanctions evasion, wire fraud). The FBI has an established intake path for suspected DPRK IT worker reports via your local field office and IC3.
- Preserve evidence before taking action: full endpoint image, authentication logs, equipment shipping records, payroll/contractor payment records, video interview recordings, and HR application metadata. The paper trail is as valuable as the endpoint.
- Coordinate the offboarding timeline with law enforcement rather than terminating on discovery — premature termination destroys evidentiary value and forfeits the opportunity for intelligence collection.
5. Compliance exposure assessment
- If a suspected worker had access to PHI (healthcare) or cardholder data, engage counsel on HIPAA breach notification and PCI-DSS implications respectively. Unauthorized access by a state-sponsored actor operating under a fraudulent identity is not a gray area.
- Review OFAC exposure: paying wages to DPRK nationals, even unknowingly, creates sanctions liability. Document your due-diligence controls — demonstrable screening processes materially affect enforcement posture.
The Bottom Line
The DPRK worker scheme expanded into healthcare and sales because defenders got better at catching it in IT. That is how adversaries work — they route around hardened controls into the functions with the least scrutiny. Your hiring pipeline is now part of your attack surface, and your HR team is now part of your security perimeter. The detections above give your SOC the endpoint and identity telemetry to catch the operational layer; the hiring and shipping controls close the front door. You need both.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.