---
title: Hunt: DPRK remote IT worker signals from the new FBI PSA and DOJ indicators | ctxsec
url: https://ctxsec.com/items/hunt-dprk-itw-2026-10
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-dprk-itw-2026-10.md)

hunt idea

2026-10-13

### Hunt: DPRK remote IT worker signals from the new FBI PSA and DOJ indicators

FBI PSA I-101326-PSA (Oct 13) says no single indicator works; layer weak signals ("identity in depth"). Endpoint signals it lists: remote desktop / RMM tools (AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop), KVM-over-IP hardware (TinyPilot, PiKVM, GL.iNet), OBS Studio with the VDO.Ninja plugin, Homebrew on non-dev roles, and high churn in bank, address and account details. DOJ's Operation Lonestar Roundup release lists 11 Gmail addresses tied to the scheme for HR and IdP watchlists.

```
// KQL sketch: stack remote-control tooling per device
DeviceProcessEvents
| where FileName in~ ("AnyDesk.exe","TeamViewer.exe","rustdesk.exe","remoting_host.exe","obs64.exe")
| summarize tools=make_set(FileName) by DeviceName
| where array_length(tools) >= 2
DeviceNetworkEvents
| where RemoteUrl has "vdo.ninja"
DeviceEvents
| where ActionType == "PnpDeviceConnected"
| where AdditionalFields has_any ("PiKVM","TinyPilot")
```

The FBI warns that aggressive filters cause false positives against legitimate remote staff. Route hits to a joint HR/security review, not auto-action. Validate process names in your environment.

Sources: [FBI/IC3 PSA I-101326-PSA](https://www.ic3.gov/PSA/2026/PSA261013) · [DOJ press release (indicators)](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker)