Insights into Suspected DPRK Workers

Huntress investigated multiple 2026 cases where suspected North Korean workers obtained remote employment at organizations across healthcare and financial services, using stolen or fabricated identity documents, VPNs/proxies (Astrill, IPRoyal, WorkTitans), file-sharing and browser tools (Toffeeshare, VDO.Ninja), and hardware backdoors (PiKVM, Guermok). The report documents forensic artifacts (Windows Event ID 6416, USB registry entries, image metadata, file timestamps), highlights behavioral patterns (activity aligned to North Korea timezone, reused document templates, tampered photos), and provides detection guidance and indicators to help defenders identify and mitigate these insider fraud and espionage risks.