FBI warns of expanding DPRK IT worker fraud
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
FBI/IC3 updates guidance as North Korean IT worker schemes expand use of facilitators, extortion, and third-party subcontracting to infiltrate Western companies.
This IC3/FBI public service announcement updates prior guidance on North Korean state-sponsored remote IT worker (ITW) schemes, describing how DPRK operatives continue to infiltrate Western companies—particularly in tech—using stolen identities to obtain remote employment. Revenue generated funds North Korea's government, including weapons programs, and the scheme poses both insider threat and IP theft risks. The advisory details tactical evolution: increased reliance on paid facilitators (witting and unwitting Americans, often financially stressed) to host 'laptop farms,' appear on camera, pass identity verification, or receive shipped devices. ITWs are increasingly subcontracting actual work to freelancers in South Asia and West Africa, complicating attribution. Notably, the FBI has observed escalation to threats of physical violence, extortion using stolen/exfiltrated corporate data, and intimidation of former employers and laptop farm operators.
The advisory emphasizes an 'identity in depth' detection philosophy for employers since no single indicator reliably identifies ITWs. Key behavioral indicators include use of remote desktop tools (AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop) and KVM-over-IP hardware (TinyPilot, PiKVM, GL.iNet) to control employer laptops remotely; use of OBS Studio with VDO.Ninja plugin and Homebrew; frequent rotation of bank accounts, addresses, and social media identities; forged verification documents; and targeting of cleared defense contractor positions and active-duty military members as laptop hosts.
For defenders, this is primarily an HR/insider-threat and identity-fraud problem requiring cross-functional collaboration between IT, HR, security, and management. Recommended mitigations include E-Verify, requiring multiple forms of ID/live verification, monitoring for remote-access tooling and KVM devices on employee-issued hardware, and treating aggregated weak signals as cause for escalated scrutiny rather than relying on name-based ban lists. Individuals are warned against accepting payment for hosting devices, appearing on camera for interviews, or sharing account credentials, and advised to contact law enforcement if threatened.
Mentioned in this report
Detection guidance
RustDesk or AnyDesk Remote Access Named Pipe Created
Detects named pipes created by RustDesk and AnyDesk, indicating remote control software on a host. The FBI reports DPRK IT workers using these tools to control employer laptops. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RustDesk or AnyDesk Remote Access Named Pipe Created
description: Detects creation of named pipes associated with RustDesk and AnyDesk
remote access tools. The FBI advisory describes DPRK remote IT workers and facilitators
using such tools to remotely control employer-issued laptops. Not malicious alone,
so correlate with asset ownership and approved software.
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: pipe_created
product: windows
detection:
selection_rustdesk:
PipeName:
- \RustDesk\query
- \RustDesk\query_cm
- \RustDesk\query_portable_service*
- \RustDesk\query_service
- \__rust_anonymous_pipe1*
selection_anydesk:
PipeName: \adprinterpipe
condition: 1 of selection_*
falsepositives:
- IT helpdesk staff using sanctioned RustDesk or AnyDesk for remote support
- Users who legitimately installed remote access tools on personal or BYOD machines
level: medium
id: 4c7313c9-5261-5f50-8101-2ba64faded81
status: experimental
author: Vorant
references:
- https://www.ic3.gov/PSA/2026/PSA261013
Remote Access Tool Silent Install or Persistence Launch Options
Detects AnyDesk or RustDesk launched with install or start-with-Windows options, a pattern used to set up persistent remote control of a laptop. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Access Tool Silent Install or Persistence Launch Options
description: Detects AnyDesk or RustDesk executed with command-line options that install
the tool as a service or configure it to start with Windows. This matches the unattended
remote control of employer laptops described for DPRK IT worker schemes and laptop
farms. Generalises on tool and flag, not on specific paths.
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_anydesk:
Image|endswith: \AnyDesk.exe
CommandLine|contains:
- --install
- --start-with-win
- --silent
selection_rustdesk:
Image|endswith: \rustdesk.exe
CommandLine|contains:
- --install
- --silent-install
- --service
condition: 1 of selection_*
falsepositives:
- Sanctioned IT deployment of AnyDesk or RustDesk for managed support
- Administrators installing remote support tools on new endpoints
level: medium
id: dda942dd-0b0c-5d35-bb7a-5b657076e7b1
status: experimental
author: Vorant
references:
- https://www.ic3.gov/PSA/2026/PSA261013
DNS Query to VDO.Ninja Video Streaming Service
Detects DNS resolution of vdo.ninja, used with OBS Studio in the reported DPRK IT worker activity to relay video and camera feeds. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DNS Query to VDO.Ninja Video Streaming Service
description: Detects DNS queries for vdo.ninja. The FBI advisory lists OBS Studio
with the VDO.Ninja plugin as an indicator of DPRK IT worker activity, used to relay
camera and video feeds during interviews and remote work. Weak signal, so use it
as an aggregated indicator on corporate endpoints.
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith: vdo.ninja
condition: selection
falsepositives:
- Legitimate use by streamers, video producers or remote-collaboration staff
- Employees testing multi-camera streaming setups
level: low
id: 590e0bd8-f5f2-5153-a6a8-27ce41460ddc
status: experimental
author: Vorant
references:
- https://www.ic3.gov/PSA/2026/PSA261013
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ic3.gov/PSA/2026/PSA261013
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs