North Korean IT Worker Fraud: DoJ Dismantles 40+ Laptop Farms — Detection and Hardening Guide for Hiring and Endpoint Teams

---
title: Remote Access Tool Execution Associated with DPRK IT Worker Laptop Farms
id: 8b2c4f61-3a7d-4e59-9c12-7f5d9e2a1b34
status: experimental
description: Detects installation or execution of remote access tools commonly abused by DPRK IT worker schemes to control farmed corporate laptops. Correlate with authorized RMM inventory before alerting.
references:
  - https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html
  - https://www.ic3.gov/PSA/2025/PSA250512
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\rustdesk.exe'
      - '\splashtop_streamer.exe'
      - '\splashtop.exe'
      - '\remoting_host.exe'
      - '\screenconnect.clientservice.exe'
      - '\atera_agent.exe'
      - '\logmein.exe'
      - '\gotomypc.exe'
      - '\vncviewer.exe'
      - '\tightvnc.exe'
  filter_authorized_paths:
    Image|startswith:
      - 'C:\Program Files\YourApprovedRMM\'
  condition: selection_img and not filter_authorized_paths
falsepositives:
  - IT-approved RMM tooling (maintain an authorized software inventory and tune)
  - Help desk remote support sessions
level: high
---
title: KVM-over-IP Device Software or Driver Installation
id: 4d1e8a27-6b3f-4c82-a956-2e7b9d4f8c15
status: experimental
description: Detects installation of KVM-over-IP control software and virtual HID/serial drivers associated with PiKVM, JetKVM, and TinyPilot-class devices used to give overseas operators hardware-level control of farmed laptops.
references:
  - https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'pikvm'
      - 'jetkvm'
      - 'tinypilot'
      - 'kvm-ip'
      - 'usbkvm'
      - 'CH341SER'
      - 'usbipd'
falsepositives:
  - Legitimate datacenter/lab KVM administration (rare on end-user laptops)
level: high
---
title: VPN Client Execution on Corporate Endpoint from Non-Standard Location
id: 9f3a7d52-1c84-4e6b-b238-5d9c1a7e4f62
status: experimental
description: Detects consumer-grade VPN client processes running on corporate endpoints, a layering technique used to mask the true origin of overseas operators controlling farmed devices.
references:
  - https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.defense_evasion
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\nordvpn.exe'
      - '\expressvpn.exe'
      - '\protonvpn.exe'
      - '\mullvad vpn.exe'
      - '\surfshark.exe'
      - '\openvpn-gui.exe'
      - '\wireguard.exe'
  filter_managed:
    ParentImage|contains: '\\Program Files\\YourCorporateVPN\\'
  condition: selection and not filter_managed
falsepositives:
  - Corporate VPN clients not in the filter list (tune to your stack)
  - Privacy-conscious employees (policy violation, not always malicious)
level: medium

// Stage 1: Remote access tool execution on endpoints with active inbound connections
let rmmTools = dynamic(["anydesk.exe","teamviewer.exe","rustdesk.exe","splashtop_streamer.exe","remoting_host.exe","screenconnect.clientservice.exe","atera_agent.exe","logmein.exe"]);
let rmmExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (rmmTools)
| project DeviceId, DeviceName, FileName, ProcessCommandLine, AccountName, TimeGenerated, ReportId;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (rmmTools)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| join kind=inner rmmExec on DeviceId
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=make_set(RemoteIP, 20), Commands=make_set(ProcessCommandLine, 10) by DeviceName, InitiatingProcessFileName, AccountName
| sort by Connections desc;
// Stage 2: Impossible travel / off-hours authentication anomalies for remote-worker accounts
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| summarize Locations=make_set(Location), Countries=make_set(LocationDetails.countryOrRegion), SessionHours=make_set(hourofday(TimeGenerated)) by UserPrincipalName, AppDisplayName
| where array_length(Countries) > 1
| project UserPrincipalName, AppDisplayName, Countries, SessionHours;

-- DPRK Laptop Farm Endpoint Triage: RMM tooling, KVM artifacts, and active remote sessions
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|remoting_host|screenconnect|atera|logmein|gotomypc|vnc)'
   OR CommandLine =~ '(?i)(pikvm|jetkvm|tinypilot|usbipd)'
UNION
SELECT NULL AS Pid, FullPath AS Name, NULL AS CommandLine, FullPath AS Exe, NULL AS Username, Mtime AS CreateTime
FROM glob(globs=['C:/Program Files*/**/*desk*.exe', 'C:/Program Files*/**/*viewer*.exe', 'C:/Users/*/AppData/**/rustdesk*.exe'])
UNION
SELECT Pid, Name, Laddr.String AS CommandLine, Raddr.String AS Exe, Status AS Username, NULL AS CreateTime
FROM netstat()
WHERE Status = 'ESTABLISHED' AND Name =~ '(?i)(anydesk|teamviewer|rustdesk|splashtop|remoting|screenconnect|vnc)'

# DPRK Laptop Farm Endpoint Audit - Security Arsenal
# Requires: Run as SYSTEM or elevated admin

$report = @()
$ts = Get-Date -Format 'yyyy-MM-dd HH:mm'

# 1. Inventory installed remote access software
$rmmNames = 'AnyDesk','TeamViewer','RustDesk','Splashtop','ScreenConnect','Atera','LogMeIn','GoToMyPC','Chrome Remote Desktop','TightVNC','UltraVNC'
$installed = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
  Where-Object { $n = $_.DisplayName; $rmmNames | Where-Object { $n -like "*$_*" } } |
  Select-Object DisplayName, DisplayVersion, InstallDate, Publisher
foreach ($i in $installed) { $report += [pscustomobject]@{Host=$env:COMPUTERNAME; Time=$ts; Category='RMM-Installed'; Detail="$($i.DisplayName) $($i.DisplayVersion)"; Publisher=$i.Publisher} }

# 2. Check for running RMM processes not on the approved list
$approved = @('YourApprovedRMM.exe')
Get-Process | Where-Object { $rmmNames | Where-Object { $_.ProcessName -like "*$_*" } } | ForEach-Object {
  if ($approved -notcontains $_.ProcessName) {
    $report += [pscustomobject]@{Host=$env:COMPUTERNAME; Time=$ts; Category='RMM-Running'; Detail="$($_.ProcessName) PID=$($_.Id) Path=$($_.Path)"; Publisher='N/A'}
  }
}

# 3. Enumerate USB devices matching KVM-over-IP / HID emulator signatures
Get-PnpDevice -Class USB -ErrorAction SilentlyContinue | Where-Object { $_.FriendlyName -match 'PiKVM|JetKVM|TinyPilot|CH340|CH341|USB Serial|HID Emulator' } | ForEach-Object {
  $report += [pscustomobject]@{Host=$env:COMPUTERNAME; Time=$ts; Category='KVM-USB-Device'; Detail="$($_.FriendlyName) [$($_.Status)] InstanceId=$($_.InstanceId)"; Publisher='N/A'}
}

# 4. Flag unexpected consumer VPN adapters
Get-NetAdapter -ErrorAction SilentlyContinue | Where-Object { $_.InterfaceDescription -match 'TAP|TUN|WireGuard|NordLynx|Mullvad' -and $_.Status -eq 'Up' } | ForEach-Object {
  $report += [pscustomobject]@{Host=$env:COMPUTERNAME; Time=$ts; Category='VPN-Adapter'; Detail="$($_.Name): $($_.InterfaceDescription)"; Publisher='N/A'}
}

# 5. Export findings for SIEM ingestion
$out = "C:\ProgramData\SecurityAudits\laptopfarm-audit-$($env:COMPUTERNAME)-$(Get-Date -Format 'yyyyMMdd').csv"
New-Item -ItemType Directory -Force -Path (Split-Path $out) | Out-Null
$report | Export-Csv -NoTypeInformation -Path $out
Write-Output "Audit complete: $($report.Count) findings written to $out"