Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
North Korean remote IT-worker schemes place DPRK-linked developers in jobs under stolen or fabricated identities. U.S.-based facilitators then receive the employer’s laptops and run them from residences or small offices—so-called “laptop farms”—while workers overseas connect through remote-desktop software or KVM-over-IP hardware. The arrangement can look like an ordinary remote hire while giving an adversary access to source code, credentials, sensitive data and company payment systems.
What a North Korean remote IT-worker scheme is
A DPRK (North Korean) remote IT-worker scheme is an employment-fraud operation. A skilled worker linked to North Korea applies for a software, engineering or other technology role while pretending to be a U.S. or other non-DPRK resident. The applicant may use a stolen identity, a fabricated résumé, pseudonymous email and payment accounts, a virtual private network, a virtual private server, proxy accounts and an IP address in a third country. A front company or convincing-looking website can make the applicant or staffing intermediary appear legitimate.
The objective is not limited to collecting a salary. A successful placement can provide legitimate credentials, access to internal applications and a trusted position from which to copy proprietary information, steal funds or support other cybercrime. The FBI has warned that some workers have used their access for data exfiltration and extortion. Department of Justice cases describe access to export-controlled military technology and about $900,000 in cryptocurrency theft in one scheme.
The schemes are usually discussed in a U.S. context because the best-documented enforcement actions involve U.S. employers and facilitators. The same identity, device and payment tactics can be adapted to employers in other countries.
#1 Best Overall
- Power over Ethernet (PoE): Comet PoE (GL-RM1PE) enables easy device powering with PoE support. Users can simply connect it to a PoE switch to eliminate extra power adapters and reduce cable clutter
- Built-in Tailscale: Enables secure, efficient data transfer between devices using WireGuard's encrypted transmission and direct connection features for home labs, offices, and multiple networking scenarios
- Dual Power Option (PoE & Type-C): Supports 5V power adapters, both PoE and the adapter can be used simultaneously for enhanced power stability
- Built-in 32GB eMMC Storage: The Comet PoE (GL-RM1PE) comes with built-in 32GB eMMC storage, pre-loaded with multiple system images for quick and reliable device restoration or updates. This simplifies system management and future-proofs your network
- 4K@30Hz HD Video & Ultra-Low Latency: Experience ultra-clear, low-latency 4K video streaming with efficient H.264 hardware encoding. Combined with built-in two-way audio, it enables seamless audio conferencing, real-time troubleshooting, and remote monitoring for professional communications and management
How a laptop farm works, step by step
“Laptop farm” does not mean a special kind of computer. It is a collection of employer-issued laptops gathered at one physical location and connected to a local U.S. network. A facilitator operates the equipment while the supposed employees work from abroad.
1. Recruitment and identity cover
DPRK-linked workers apply through job boards, freelance marketplaces or staffing channels. They may submit someone else’s identity documents, create a synthetic identity, or combine real personal details with false employment history. Accounts for email, payments and communications are often opened under the assumed identity. VPNs, proxies and third-country infrastructure hide the worker’s actual network location.
Some operations establish front companies or fake business websites. Those materials can reassure a recruiter that a staffing firm, résumé or work history is genuine when it is controlled by the same network.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Delivery to a U.S. address
After hiring, the employer ships its laptop to the address supplied by the supposed employee. The address may be a facilitator’s home, a small office or another location able to receive packages. One facilitator can accept devices for many different employers, creating a concentration of machines that would not be visible from each employee’s résumé or interview.
Rank #2
- Open-source software
- Free & Optional Remote Access
- Ultra-low Latency
- microSD card included
- Full-size HDMI
3. Making the laptop appear local
The facilitator connects each laptop to a U.S.-based internet service. Remote-desktop software or external KVM-over-IP hardware then lets the overseas worker see and control the physical computer. Because the laptop’s network connection originates at the expected U.S. address, routine employer checks may show a plausible location even though the person typing is abroad.
A KVM (keyboard, video and mouse) over IP device acts like a network-controlled physical console. It can transmit the laptop’s display and keyboard or mouse input without requiring the overseas operator to log in through the company’s approved remote-access service. FBI and DOJ reporting has identified TinyPilot-, PiKVM- and similar hardware in seized farms; the hardware category itself is not proof of wrongdoing, but an unexplained device attached to a corporate laptop warrants investigation.
4. Performing ordinary work
The worker completes normal development or support tasks so the account appears productive. Code commits, ticket updates, meetings and messages can therefore look routine. At the same time, the account may expose source repositories, cloud consoles, credentials, customer records or other systems that the role can reach.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →5. Routing and laundering pay
Salary or contract payments may first go to a U.S. bank account or an account controlled by a facilitator. The facilitator keeps a fee or share and transfers the balance to accounts controlled by DPRK workers or laundering partners. This payment chain helps conceal the worker’s nationality and supports the North Korean government’s prohibited revenue streams.
Rank #3
- 【4K HDMI Extension up to 120m over Ethernet】Extend HDMI video, audio, and USB signals up to 120m(390ft) using a single Cat5e/6/6a/7 Ethernet cable. Supports 4K@30Hz and 1080P@120Hz with smooth performance and 7.1-channel audio—ideal for remote workstations, gaming setups, and AV installations without long HDMI cables.
- 【KVM Extension Over Your Existing IP Network】 Leverage your current Ethernet infrastructure—no dedicated KVM cabling, no costly rewiring. Deploy remote keyboard, mouse, and peripheral control anywhere there's a network connection, reducing installation costs, shortening deployment time, and making post-installation upgrades simple and scalable. Perfect for server rooms, control centers, and distributed workstations.
- 【Remote Control with USB Keyboard & Mouse】Built-in USB 2.0 KVM extender allows you to control a remote PC, server, or game console using a keyboard, mouse, or controller. The receiver includes 3 USB ports (480Mbps) for peripherals like flash drives, gamepads, or printers.
- 【Flexible Setup for Multiple Systems】The 4-pin DIP switch design supports up to 16 extender sets operating within the same network. Easily pair each transmitter (TX) and receiver (RX) by matching switch positions, making it ideal for control rooms, offices, classrooms, and digital signage systems.
- 【Stable Long-Distance Transmission】Designed for reliable signal delivery across long distances. When used through a Gigabit network switch, the system maintains the high bandwidth needed for stable video and USB transmission—perfect for centralized equipment rooms or rack installations.
6. Scaling into a farm
Once the arrangement works for one device, the facilitator can repeat it. Multiple laptops share the same residence, office, internet connection, power and KVM infrastructure. The October 2026 DOJ operation illustrates the possible scale: agents seized approximately 187 laptops and KVM devices and searched more than 40 suspected Texas laptop farms. A farm can therefore span dozens of addresses and hundreds of devices rather than one conspicuous room.
What the published cases show about scale
| Finding | Attribution and qualification |
|---|---|
| Thousands of skilled IT workers | U.S. Department of the Treasury, 2025; an estimate for the broader DPRK worker program. |
| Up to 90% of wages withheld | U.S. Department of the Treasury, 2025; the figure describes the share the DPRK government may take, not a universal deduction in every case. |
| Hundreds of millions of dollars in annual revenue | U.S. Department of the Treasury, 2025; an estimate for yearly program revenue. |
| More than 70 U.S. company employers and about $3 million generated | U.S. Department of Justice, 2026; figures from a specific enforcement action. |
| About 187 laptops and KVM devices seized; searches at more than 40 suspected Texas farms | U.S. Department of Justice, October 2026; seizure and search figures from that operation. |
| More than 100 U.S. companies obtained as employers | U.S. Department of Justice, 2025; figure from a nationwide case. |
| Up to $300,000 in annual earnings for one worker | U.S. Department of Justice, 2025, quoting the 2022 tri-seal advisory; an earlier advisory estimate, not a typical salary. |
These numbers describe different investigations and time periods, so they should not be added together. They do establish that the operation is an organized revenue model rather than an isolated résumé fraud.
Why a fraudulent hire is a security incident
An employer can lose more than the wages paid to a false employee. A developer account may have read or write access to source code, build systems, secrets, production environments and customer data. The FBI reports that DPRK-linked workers have used legitimate access to exfiltrate proprietary information, conduct data extortion and facilitate cybercrime.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Intellectual-property loss: source code, product plans, algorithms and internal documentation can be copied.
- Credential exposure: tokens, passwords, signing keys and cloud credentials may be accessible from the worker’s workstation or repositories.
- Regulatory and national-security exposure: a DOJ case described access to export-controlled military technology.
- Direct theft: one DOJ case involved approximately $900,000 in cryptocurrency theft.
- Extortion: stolen files can be used to demand payment or threaten disclosure.
- Sanctions and reputational risk: payments can support DPRK programs that the United States sanctions, while an employer may face legal scrutiny for weak hiring and access controls.
DOJ Assistant Attorney General John A. Eisenberg said on June 30, 2025: “These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs.” In an October 13, 2026 release, DOJ stated: “Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”
Rank #4
- Easy to Install JetKVM：Connect the Jet KVM to your device you wish to control via USB-C and HDMI, then attach your IP KVM to network by an ethernet cable.Enter the displayed IP address in any browser and you're ready for remote control.
- KVM Over IP with 3 Access Options：Local Access way by typing KVM's IP address into any browser.Remote Cloud Access by logging into the cloud dashboard from anywhere. Wake on LAN option by Sending magic packet via MAC address to wake device remotely.
- Ultra-low Latency IP KVM：1080*1920p@60FPS video with 30-60ms latency using H.264 encoding. Smooth mouse and keyboard interaction for responsive remote control.Jet KVM provides a video quality toggle with three options（High,Medium,Low),allowing you to adjust the video stream's bitrate based on your connection speed and resolution needs.
- KVM-Over-IP with Flexible Power Options：Here are the four power supply methods for JetKVM.Power JetKVM via USB-C from the controlled device.You can supply the ip KVM from a separate 5V power supply or from DC Extension/ATX Board Extension.
- Open-Source KVM over Ethernet: The JetKVM is built for Collaboration on a robust Golang foundation and powered by Linux. Whether you're a seasoned developer or an enthusiastic tinkerer,you can easily modify or fine-tune the software using familiar tooling and straightforward SSH uploads.
Red flags in a suspected DPRK IT-worker placement
No single clue proves that a worker is North Korean. Legitimate contractors travel, use privacy tools or need a nonstandard delivery address. Treat the following as combinations to investigate, not as an automated nationality test.
Identity and hiring inconsistencies
- The résumé, identity document, professional profile and employment history contain small differences in names, dates, photographs or locations.
- A candidate avoids a live video interview, appears to be coached, or cannot answer detailed questions about work claimed in the résumé.
- References use generic email addresses, cannot verify dates, or route calls through someone other than the named employee.
- The physical address supplied for shipping differs from the address on identity documents without a documented explanation.
- A staffing vendor refuses to disclose who performed identity checks or cannot explain how it verified the worker’s right to work.
Device, network and workplace indicators
- Several unrelated employees’ laptops ship to the same residence, office or mailbox.
- An employer laptop has an unauthorized remote-desktop application, unexpected KVM-over-IP hardware, extra USB devices or unexplained network equipment.
- Login geography, time-of-day activity or device telemetry conflicts with the employee’s stated location and schedule.
- Tools are installed outside the approved software process, local administrator rights are used unexpectedly, or security controls are repeatedly disabled.
- Large or unusual transfers leave repositories, cloud storage or internal file shares without a business explanation.
Payment and vendor signals
- Payroll instructions change soon after hiring, use a third party, or point to an account whose owner does not match the employee.
- A contractor insists that all communication and payment go through an intermediary that will not provide verifiable corporate details.
- The same contact information, résumé language, bank details or technical fingerprints appear across supposedly unrelated applicants.
How companies can prevent and detect a fake remote employee
Official guidance emphasizes layered controls. Identity assurance, device assurance, network control, vendor coverage and response speed address different parts of the scheme; removing one check leaves another avenue open.
| Control area | Practical measures | What it addresses |
|---|---|---|
| Identity assurance | Verify identity documents, employment history, references and physical address. Conduct a live video interview and require additional proof when the shipping address differs from identity records. Complete background checks before granting access. | Stolen identities, fabricated résumés and coached applicants. |
| Device assurance | Record asset serial numbers and shipping destinations, reconcile every issued device, use tamper-evident procedures where appropriate, and inspect for unauthorized KVM, USB and network hardware. | Facilitators receiving multiple employer laptops and hiding the true operator. |
| Network control | Disable or tightly restrict remote-desktop protocol and remote-desktop applications unless a documented business need is approved. Monitor login geography, endpoint telemetry and unusual data transfers. | Overseas control and location obfuscation. |
| Least privilege | Remove local administrator rights, limit software installation, separate development and production credentials, require strong multifactor authentication and review access regularly. | Limiting the damage if a hire is fraudulent or an account is compromised. |
| Vendor coverage | Apply the same identity, address, background and device checks to contractors, staffing firms and subcontractors. Put audit and notification duties in contracts. | Indirect hiring channels, which are a common route into companies. |
| Response speed | Centralize endpoint, identity, network and cloud logs; define an escalation owner; practice account isolation and device collection. | Reducing dwell time and preserving evidence. |
Human resources, procurement and security teams should share these checks. A technically strong candidate can still be fraudulent, and a reputable staffing vendor does not eliminate the employer’s responsibility to verify the person and device receiving access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do when you suspect a laptop farm
- Preserve evidence. Keep identity records, interview notes, shipping data, payroll changes, endpoint alerts, authentication logs, cloud audit trails and relevant messages. Do not reimage or return a device before security staff capture what they need.
- Contain access. Suspend the suspected account, revoke sessions and tokens, rotate exposed credentials, and restrict connected accounts. Coordinate the timing with incident-response personnel so evidence is not destroyed.
- Isolate equipment safely. Remove the laptop from production networks while preserving its state for forensic collection. Inventory attached USB, KVM, network and storage devices.
- Scope the intrusion. Search for the same identity details, bank information, shipping address, remote-access software, IP patterns and repository activity across employees, contractors and vendors.
- Notify the right authorities. The FBI advises affected organizations to report suspected activity to their local FBI field office and the Internet Crime Complaint Center (IC3). Preserve the case number and provide requested records.
- Remediate and review. Reissue credentials, patch or rebuild affected endpoints after collection, close unnecessary privileges, and update hiring, shipping and vendor procedures based on what failed.
Do not confront a suspected facilitator by deleting accounts or shipping the laptop back without guidance. Premature action can alert other participants and destroy evidence needed to determine whether data or funds were taken.
Best Value
- The next generation of Raspberry Pi based KVM over IP. Manage your servers or PC remotely! PiKVM is a feature-rich, production grade, open-source, Raspberry Pi based KVM IP device.
- Transfer your mouse and keyboard actions to a remote PC using this remote kvm over ip. Take full control of a remote PC’s power: Pi KVM provides remote reset or reboot using the actual hardware reset & power buttons connector functions.
- Access to all configuration settings of a remote computer like tweaking UEFI/BIOS settings to do some overclocking! Boot a controlled PC using any OS you need using mass storage device emulation support. You can even reinstall the system remotely using this mini kvm!
- PiKVM Fanless design with a passive heatsink for quiet ipkvm operation
- Includes a locator led simplifying your device search.
What laptop farms do—and do not—prove
A laptop farm is evidence of a device-and-access arrangement, not by itself proof that every person associated with the address is a DPRK worker. Shared offices, managed-service providers and legitimate remote-support operations can also hold multiple laptops. Investigators need corroboration from identity records, payment flows, access logs, communications and forensic evidence.
Likewise, a U.S. IP address does not establish that the person working is in the United States. The local connection may belong to a facilitator while the operator is overseas. Conversely, a foreign login or an installed remote-access tool is not conclusive without context. The strongest assessment combines identity, device, network, vendor and behavioral evidence.
Bottom line for employers
North Korean remote IT-worker schemes turn ordinary remote hiring into a potential insider-threat and sanctions problem. Laptop farms make overseas control look local by placing employer devices on a U.S. network and exposing their screens and inputs through remote software or KVM hardware. Preventing the scheme requires verification before access, strict control of shipped devices, least-privilege accounts, monitoring for remote-control indicators and a practiced incident-response plan. If a placement appears fraudulent, preserve the evidence, isolate access and report promptly rather than treating it as a payroll dispute.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
