Laptop farms and remote KVM hardware

Suspected DPRK workers turn up in healthcare and sales roles, Huntress says

The tells in three Huntress cases were login timestamps, duplicate passport scans and a KVM box on a fresh laptop, which puts the people most likely to catch a North Korean hire in HR and IT onboarding rather than in the SOC.