North Korean remote IT-worker schemes place DPRK-linked developers in jobs under stolen or fabricated identities. The worker may look like a U.S.-based contractor, but a facilitator receives the company laptop, keeps it on a U.S. internet connection, and lets the overseas worker control it through remote-access software or a KVM-over-IP device. Salary is collected through U.S. accounts and transferred to DPRK-controlled accounts or intermediaries.
For an employer, this is not only hiring fraud. A person who passes as a legitimate developer can obtain source code, credentials, cloud access and sensitive data, then use that access for theft or extortion. A laptop farm is the physical infrastructure that makes many such placements appear to originate from normal U.S. homes or offices.
As an Amazon Associate I earn from qualifying purchases.
What a North Korean remote IT-worker scheme is
The Democratic People’s Republic of Korea (DPRK) sends skilled information-technology workers into foreign companies by disguising their identity, location and financial connections. Applications can use stolen identities, fabricated résumés, pseudonymous email and payment accounts, virtual private networks, virtual private servers, proxy accounts and third-country IP addresses. A front company or convincing staffing website may make the applicant or intermediary appear legitimate.
The worker usually performs ordinary software-development or application-support tasks. That normal output is important: it establishes a work history, earns continued access and makes unusual activity less conspicuous. Once trusted, the worker may reach proprietary source code, credentials, internal systems, export-controlled technology or financial assets.
#1 Best Overall
- Power over Ethernet (PoE): Comet PoE (GL-RM1PE) enables easy device powering with PoE support. Users can simply connect it to a PoE switch to eliminate extra power adapters and reduce cable clutter
- Built-in Tailscale: Enables secure, efficient data transfer between devices using WireGuard's encrypted transmission and direct connection features for home labs, offices, and multiple networking scenarios
- Dual Power Option (PoE & Type-C): Supports 5V power adapters, both PoE and the adapter can be used simultaneously for enhanced power stability
- Built-in 32GB eMMC Storage: The Comet PoE (GL-RM1PE) comes with built-in 32GB eMMC storage, pre-loaded with multiple system images for quick and reliable device restoration or updates. This simplifies system management and future-proofs your network
- 4K@30Hz HD Video & Ultra-Low Latency: Experience ultra-clear, low-latency 4K video streaming with efficient H.264 hardware encoding. Combined with built-in two-way audio, it enables seamless audio conferencing, real-time troubleshooting, and remote monitoring for professional communications and management
The U.S. Treasury said in 2025 that thousands of skilled IT workers participate in these operations, that the DPRK government can withhold up to 90% of their wages, and that the programs generate hundreds of millions of dollars annually. Those are government estimates for the broader program, not a guaranteed amount for any individual placement.
U.S. Department of Justice cases show the consequences at company level. A 2025 nationwide case involved more than 100 U.S. companies. In a separate 2026 case, more than 70 U.S. employers were affected and approximately $3 million was generated. An earlier DOJ estimate, quoting the 2022 tri-seal advisory, put potential annual earnings for one worker at up to $300,000.
How a laptop farm operates
A laptop farm is not a special type of computer. It is a group of employer-issued laptops gathered at one or more U.S. locations and maintained so overseas workers can operate them as if they were physically present in the United States. The same arrangement can be spread across residences, small offices or rented rooms to avoid creating one obvious concentration.
| Stage | What happens | Why it helps the scheme |
|---|---|---|
| Recruitment and cover | A worker applies with a stolen or invented identity, false résumé, alternate accounts and location-obscuring network services. A front company may act as the staffing intermediary. | The employer sees a plausible non-DPRK candidate and may never learn the worker’s real location. |
| Device delivery | The employer ships its laptop to the address supplied by the supposed employee. A facilitator receives it, sometimes receiving devices from many unrelated employers. | The employer’s hardware is physically inside the United States even though the worker is abroad. |
| U.S. presence simulation | The facilitator provides a local broadband connection and configures remote-desktop software or external KVM-over-IP hardware. | Logins, IP addresses and device activity can appear consistent with the expected U.S. location. |
| Remote work | The overseas worker controls the company laptop and performs routine tasks, communicates with colleagues and uses approved applications. | Normal work builds trust while the account may expose sensitive systems. |
| Payment routing | Wages go to U.S. accounts or facilitator-controlled accounts. Money is transferred to DPRK-linked workers or laundering partners, after fees or revenue shares. | The employer pays a seemingly ordinary employee while funds are redirected to the DPRK program. |
| Scaling | More employer laptops are added to the same local infrastructure or to a network of similar locations. | One facilitator can support many placements and make the operation economically viable. |
How overseas control reaches the laptop
There are two broad technical patterns. Remote-desktop software runs on the laptop or through an installed agent and passes keyboard, mouse, screen and sometimes file-transfer functions over the internet. A KVM-over-IP device operates below the operating system: it connects to the laptop’s video output and USB ports, allowing a distant operator to see the screen and send keyboard and mouse input. Because the laptop itself remains at a U.S. address, ordinary geolocation checks can be misleading.
Rank #2
- Open-source software
- Free & Optional Remote Access
- Ultra-low Latency
- microSD card included
- Full-size HDMI
Investigators have identified TinyPilot-, PiKVM- and similar KVM-over-IP hardware in laptop farms. The existence of one of these devices is not proof of a DPRK placement; legitimate IT teams also use remote console equipment. It is a high-value signal when combined with an unexplained shipping address, inconsistent identity evidence, unusual login geography or an unauthorized remote-access application.
Why many devices are called a “farm”
The term describes scale and co-location, not a particular product. A facilitator can run several laptops from a residence with a network switch, power strips and KVM equipment, or distribute them among dozens of addresses. In an October 2026 operation, the DOJ reported searches at more than 40 suspected Texas laptop farms and the seizure of approximately 187 laptops and KVM devices. That operation demonstrates that a farm can involve hundreds of devices across many residences rather than one warehouse.
What employers risk after a fraudulent hire
Data theft and extortion
The FBI has reported cases in which workers used legitimate access to exfiltrate proprietary or sensitive information. A person who can read repositories, download databases or reach cloud consoles can quietly copy material before anyone questions the identity. The same access can later support data extortion: the actor threatens disclosure or demands payment after removing files.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Technology and intellectual-property exposure
DOJ cases describe access to export-controlled military technology. A developer who appears to be working on an ordinary application may still be able to reach engineering documents, build systems or restricted project data through shared credentials and overly broad permissions.
Rank #3
- 【4K HDMI Extension up to 120m over Ethernet】Extend HDMI video, audio, and USB signals up to 120m(390ft) using a single Cat5e/6/6a/7 Ethernet cable. Supports 4K@30Hz and 1080P@120Hz with smooth performance and 7.1-channel audio—ideal for remote workstations, gaming setups, and AV installations without long HDMI cables.
- 【KVM Extension Over Your Existing IP Network】 Leverage your current Ethernet infrastructure—no dedicated KVM cabling, no costly rewiring. Deploy remote keyboard, mouse, and peripheral control anywhere there's a network connection, reducing installation costs, shortening deployment time, and making post-installation upgrades simple and scalable. Perfect for server rooms, control centers, and distributed workstations.
- 【Remote Control with USB Keyboard & Mouse】Built-in USB 2.0 KVM extender allows you to control a remote PC, server, or game console using a keyboard, mouse, or controller. The receiver includes 3 USB ports (480Mbps) for peripherals like flash drives, gamepads, or printers.
- 【Flexible Setup for Multiple Systems】The 4-pin DIP switch design supports up to 16 extender sets operating within the same network. Easily pair each transmitter (TX) and receiver (RX) by matching switch positions, making it ideal for control rooms, offices, classrooms, and digital signage systems.
- 【Stable Long-Distance Transmission】Designed for reliable signal delivery across long distances. When used through a Gigabit network switch, the system maintains the high bandwidth needed for stable video and USB transmission—perfect for centralized equipment rooms or rack installations.
Financial and cybercrime consequences
One DOJ-described scheme involved approximately $900,000 in cryptocurrency theft. A compromised account can also be used to stage malware, create fraudulent cloud resources, attack customers or hide activity behind the employer’s infrastructure. The employer may face regulatory, contractual and notification duties even if the initial deception was carried out by an outside facilitator.
Sanctions and national-security exposure
The money is intended to support the DPRK state. DOJ Assistant Attorney General John A. Eisenberg said on June 30, 2025: “These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs.” The October 2026 DOJ release similarly stated: “Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”
Red flags that deserve investigation
No single clue reliably identifies a DPRK worker. Fraudsters deliberately create ordinary-looking records, and legitimate remote employees can travel, use privacy tools or need unusual equipment. Treat the following as a combined risk pattern, not an automatic accusation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- The shipping address differs from the address on identity documents, tax forms or employment records, with no clear business explanation.
- A candidate cannot provide consistent employment history, references or location details, or gives answers that do not match the résumé.
- Video interviews appear staged, show repeated connection problems or avoid live identity verification.
- The person asks a staffing intermediary, friend or “IT support” contact to receive and configure the company laptop.
- Several unrelated employees’ devices appear to share one residential network, hardware inventory or local support contact.
- Endpoint telemetry shows remote-desktop tools, unauthorized browser extensions, unexpected virtual machines or new USB and KVM devices.
- Authentication records show improbable travel, a sudden change in geography, logins through anonymizers or simultaneous sessions from distant regions.
- Data transfers, repository downloads or cloud-console activity are abnormal for the person’s role or working hours.
- The worker resists local device inspection, refuses to use approved identity-verification steps or insists on local administrator rights.
How to prevent a fake remote employee
1. Establish identity before granting access
- Compare government identity documents with the résumé, employment forms, payment details and the proposed physical address.
- Conduct a live video interview in which the candidate answers role-specific questions and follows an unscripted verification prompt.
- Check employment history and references independently rather than relying only on contact details supplied by the applicant.
- Complete the background check before issuing credentials or shipping a device.
- Require additional proof when the delivery address differs from identity documents, such as a lease, utility record or documented business relationship.
Apply these controls to contractors, subcontractors and staffing-vendor personnel. DOJ cases show that contract labor can be the route into a company, so a direct employee policy alone leaves a major gap.
Rank #4
- Easy to Install JetKVM：Connect the Jet KVM to your device you wish to control via USB-C and HDMI, then attach your IP KVM to network by an ethernet cable.Enter the displayed IP address in any browser and you're ready for remote control.
- KVM Over IP with 3 Access Options：Local Access way by typing KVM's IP address into any browser.Remote Cloud Access by logging into the cloud dashboard from anywhere. Wake on LAN option by Sending magic packet via MAC address to wake device remotely.
- Ultra-low Latency IP KVM：1080*1920p@60FPS video with 30-60ms latency using H.264 encoding. Smooth mouse and keyboard interaction for responsive remote control.Jet KVM provides a video quality toggle with three options（High,Medium,Low),allowing you to adjust the video stream's bitrate based on your connection speed and resolution needs.
- KVM-Over-IP with Flexible Power Options：Here are the four power supply methods for JetKVM.Power JetKVM via USB-C from the controlled device.You can supply the ip KVM from a separate 5V power supply or from DC Extension/ATX Board Extension.
- Open-Source KVM over Ethernet: The JetKVM is built for Collaboration on a robust Golang foundation and powered by Linux. Whether you're a seasoned developer or an enthusiastic tinkerer,you can easily modify or fine-tune the software using familiar tooling and straightforward SSH uploads.
2. Control the device chain
- Record the laptop’s serial number, hardware configuration and assigned user before shipment.
- Use tracked delivery and require confirmation from the verified recipient at the approved address.
- Have the employee complete an initial video call while opening the sealed package and enrolling the device in endpoint management.
- Block unapproved peripherals and alert on unexpected USB, KVM or capture hardware.
- Maintain an inventory that links every device to one person, one address and one employment record.
3. Reduce what a new account can do
Use least privilege from the first login. Disable local administrator accounts, restrict software installation and place source repositories, production systems, secrets and export-controlled projects behind separate approvals. A developer should receive only the projects and environments required for the assigned work. Separate privileged administration from ordinary development accounts, require phishing-resistant multifactor authentication where practical and review dormant or unused access promptly.
4. Govern remote access deliberately
Disable Remote Desktop Protocol and other remote-desktop applications on company devices unless a documented business requirement has been approved. Where remote support is necessary, limit it to managed tools, approved support windows and named administrators. Monitor for new remote-access services, persistence mechanisms, screen-sharing agents and changes to firewall or proxy settings.
5. Monitor behavior, not just the résumé
Collect endpoint, identity, VPN, DNS, repository and cloud-audit logs centrally. Alert on impossible-travel patterns, unexpected login countries, simultaneous sessions, large repository exports, unusual archive creation, secret-store access and transfers to unfamiliar destinations. Correlate these events with device location, shipping records and HR data; a technically normal login can become suspicious when the associated laptop is registered to a different address.
How to compare defensive controls
| Control area | Strong practice | What it catches or limits | Remaining limitation |
|---|---|---|---|
| Identity assurance | Document checks, live interview, references, background screening and address verification | Stolen identities, fabricated histories and undisclosed intermediaries | Convincing documents or a recruited facilitator can still pass one check |
| Device assurance | Verified shipping, serial-number inventory, enrollment at first use and peripheral monitoring | Third-party receipt of laptops, KVM hardware and device substitution | A legitimate employee may use approved remote-support equipment |
| Network control | Restricted remote-desktop software, least privilege, multifactor authentication and geography alerts | Overseas control, unauthorized persistence and excessive account reach | Proxy services can make location signals imperfect |
| Vendor coverage | Identical checks for employees, contractors and staffing suppliers, with audit rights in contracts | Fraud entering through labor vendors | Weak vendor records can delay verification |
| Response speed | Central logs, rehearsed isolation, preserved devices and rapid reporting | Limits dwell time and supports investigation | It reduces damage after access exists; it does not prevent the initial deception |
Layer these controls. An IP address, a shipping address or a KVM alert by itself is not conclusive, but several independent mismatches justify pausing access and conducting a documented review.
Best Value
- The next generation of Raspberry Pi based KVM over IP. Manage your servers or PC remotely! PiKVM is a feature-rich, production grade, open-source, Raspberry Pi based KVM IP device.
- Transfer your mouse and keyboard actions to a remote PC using this remote kvm over ip. Take full control of a remote PC’s power: Pi KVM provides remote reset or reboot using the actual hardware reset & power buttons connector functions.
- Access to all configuration settings of a remote computer like tweaking UEFI/BIOS settings to do some overclocking! Boot a controlled PC using any OS you need using mass storage device emulation support. You can even reinstall the system remotely using this mini kvm!
- PiKVM Fanless design with a passive heatsink for quiet ipkvm operation
- Includes a locator led simplifying your device search.
What to do when a placement is suspected
- Do not confront the worker or wipe the laptop before preserving evidence.
- Preserve identity-provider, endpoint, VPN, repository, email, cloud and payment-related logs according to your incident-response plan.
- Isolate affected accounts and devices, revoke active sessions and rotate exposed credentials. Keep a forensic image or the original device when investigators require it.
- Review the worker’s access for repository downloads, secret retrieval, unusual exports, new accounts and contact with external infrastructure.
- Check whether the same address, facilitator, bank account, device pattern or vendor appears in other employee records.
- Report suspected activity to the FBI field office and the Internet Crime Complaint Center (IC3), and coordinate with legal, sanctions-compliance and affected customers as required.
Isolation should be precise: disabling one account may not stop a facilitator who controls several employees’ laptops or has copied reusable credentials. Investigators should map every linked identity, device and access token before declaring the incident contained.
Why ordinary hiring checks are not enough
Traditional screening assumes the applicant and the person doing the work are the same individual, that the laptop reaches that person and that the login location reflects where the work occurs. Laptop farms break all three assumptions. A facilitator can pass delivery checks, a remote operator can produce normal work, and a U.S. IP address can belong to a house containing equipment controlled from another country.
The practical answer is not to ban remote work or foreign-born engineers. It is to verify identity and device custody continuously, give every worker only the access their role needs, and make anomalous remote control visible. Companies that combine those measures can detect a fabricated employee earlier and limit the value of any account that slips through.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
