Guermok USB capture card

Suspected DPRK workers turn up in healthcare and sales roles, Huntress says

The tells in three Huntress cases were login timestamps, duplicate passport scans and a KVM box on a fresh laptop, which puts the people most likely to catch a North Korean hire in HR and IT onboarding rather than in the SOC.