Unmasking a North Korean IT Farm: How North Korean IT Workers Stay Undetected

Executive Summary

In an era of remote work and widespread SaaS adoption, the most dangerous adversaries may not need to breach your defenses—they may already be inside, posing as employees.

In mid-2024, a North Korean IT worker, hired under false pretenses by a Western organization, was discovered operating a covert, multi-layered remote-control system. The operation leveraged a combination of low-level protocol signaling and legitimate collaboration tools to maintain remote access and enable data visibility and control using Zoom. While no confirmed data exfiltration was observed, the infrastructure demonstrated clear capability for persistent access and interaction.

The attack chain, uncovered during forensic investigation, involved the abuse of ARP packets to trigger event-based actions, a custom WebSocket-based command-and-control (C2) channel, and automation of Zoom’s remote-control features. This case illustrates how legitimate software and overlooked network behaviors can be weaponized to bypass endpoint detection and traditional security controls.

Organizations must look beyond shell commands and malware signatures to detect threats that operate within trusted workflows and tools. This report provides a detailed breakdown of the attacker’s architecture, including toolsets, communication paths, forensic findings, and recommended detection strategies.

Incident Overview and Key Findings

The campaign was initially uncovered by a U.S. federal law enforcement agency during a raid on a suspected laptop farm used to help workers posing as U.S. citizens to gain remote employment with Western companies. The facility was operated by US citizens working, perhaps unknowingly, with the North Korean government for an unknown sum of money.  During the raid, multiple devices were seized—including a corporate-issued laptop that had been shipped to the fraudulent employee as part of their onboarding process.

This device was returned to the company and subsequently submitted to Sygnia for forensic investigation. Upon inspection, analysts uncovered a complex web of lightweight Python scripts and hidden backdoor components embedded within the user’s development environment.

The attacker, a North Korean national operating under a false identity with forged documentation, had gained employment through an outsourcing platform. Using the company-issued laptop and VPN access, the attacker—physically located in Asia—was able to connect to internal systems under the guise of legitimate work.

What appeared to be a legitimate development workspace concealed a modular remote-control system. By embedding the tooling into routine workflows and relying on legitimate software, such as Python utilities, WebSocket clients, and the Zoom application, the attacker avoided triggering traditional security controls. The scripts were intentionally minimalistic, relying on common OS commands and open-source libraries to blend into the surrounding development environment.

Persistence was achieved through shell scripts configured to auto-execute on login or system startup, allowing the attacker’s tooling to remain active during work hours without raising suspicion.

Key Findings

• Distributed Command Execution – A central WebSocket server received and broadcasted commands to connected clients.
• Network-Based Control Relays – Components listened for ARP packets, extracted payloads, and rebroadcasted them to propagate commands across the network.
• Simulated User Input – Scripts executed HID (keyboard and mouse) actions locally to mimic legitimate user behavior and execute keyboard shortcuts.
• Zoom Client Automation – A script launched the Zoom application and approved remote control prompts via system-level input simulation. The script does not exploit Zoom to gain this functionality. The script opens and accesses Zoom on the local machine and uses the intended features of Zoom to gain remote access. 
• Espionage & Insider Risk Potential – The attacker achieved persistent access and remote interaction by abusing trust in common SaaS tools and development workflows. No evidence of data exfiltration or unauthorized surveillance was confirmed during analysis, but the tooling demonstrated clear potential for these capabilities.

Malicious System Architecture

The covert toolset uncovered during analysis was composed of several modular components, each designed to facilitate remote access and stealthy command execution. A key element of this architecture was the strategic implementation of WebSockets, which enabled real-time, full-duplex (bidirectional) communication between compromised client machines and attacker-controlled servers. Unlike traditional HTTP-based polling mechanisms, WebSockets maintained persistent, long-lived connections capable of carrying lightweight, custom payloads, significantly reducing the visibility to network security monitoring.

Specifically, WebSockets provided the attackers with continuous, low-profile beaconing from victim machines, minimizing detection risks; real-time delivery and execution of commands such as “open_zoom” and “approve_remote,” enhancing responsiveness and attacker control; and reduced visibility and logging from conventional network inspection tools, enhancing operational stealth.

While the attack could launch Zoom and automate remote control approval, their presence in the meeting would still be visible to other participants through standard Zoom UI elements such as the participant list and control notifications. No capabilities were observed that bypassed these built-in security prompts. The modular components of the malicious architecture included:

• Network Listener Module: Captured ARP packets on the local network and forwarded relevant metadata to a remote WebSocket-based command server.
• Command Rebroadcast Relay: Received instructions from the C2 infrastructure and rebroadcast them as ARP packets to other devices within the same LAN, enabling decentralized command propagation.
• Input Simulation Agent: Parsed incoming ARP-based or WebSocket-sourced commands and simulated human input using keyboard and mouse emulation to covertly interact with the host system.
• Video Conferencing Automation Module: Designed to manipulate Zoom activity, this utility automated application launch, session joining, and remote-control approval—enabling full desktop control through user-side scripting and automation, minimizing user interaction and visual cues through configuration.
• User Presence Beaconing Script: Periodically notified the attacker’s C2 server when the host is active.

Attack Flow

Once a machine was compromised, the attack unfolded methodically, beginning with subtle reconnaissance and escalating to complete surveillance and control. Initially, a lightweight User Presence Beaconing script periodically informed the attacker’s WebSocket server whenever the host was active. This ensured commands from the attacker were only issued during periods of user activity, significantly reducing the likelihood of detection.

Subsequently, the attacker established Command and Control (C2) communication. The Command Rebroadcast Relay connected to the WebSocket server, receiving precise instructions—such as initiating Zoom sessions or simulating human input—and immediately rebroadcasting these commands as ARP packets to other compromised devices within the local network. Concurrently, the Network Listener Module monitored ARP traffic, forwarding relevant data back to the attacker’s server via WebSockets, enabling real-time coordination and detailed logging of compromised network activity.

Leveraging these established communication channels, the attacker coordinated activity between devices under their control. Encoded commands were broadcasted over ARP to trigger actions on other compromised endpoints running the Input Simulation Agent.

While ARP rebroadcasting was limited to the local network segment, this method enabled coordinated HID control across multiple devices within the attacker’s infrastructure, a compromised laptop farm. The scripts used Scapy on the eth0 interface, which suggests communication occurred at the Ethernet layer among co-located devices.

Although ARP traffic does not typically traverse VPN tunnels, in a hypothetical scenario where the attacker compromised a second device within the same internal flat subnet and adjusted the script to interface with a TAP-based VPN or local virtual bridge, this technique could theoretically enable multi-endpoint command propagation. No such pivoting was observed during investigation, and this remains a speculative extension of the attacker’s demonstrated capabilities.

The attackers employed the Video Conferencing Automation Module to launch Zoom meetings and automate remote control approval. Once approval was given, the application was treated as a Remote Administration Tool (RAT) by the threat actor. The meeting was created and hosted by the attacker’s system, and approval was granted through local scripting using standard input automation. While this technique could allow remote interaction during a meeting initiated by the attacker, no evidence of data exfiltration or unauthorized surveillance was observed during forensic review. All Zoom UI elements (e.g., participant list, remote control prompts) would remain visible to the user under normal circumstances.

To further enhance stealth and automation, specific Zoom client configurations were required. Settings were meticulously adjusted to prevent user-facing indicators and audio-visual disturbances. Users were persistently signed in, video and audio were automatically muted upon joining, participant names were hidden, screen sharing initiated without visible indicators, and preview windows disabled. These configurations were adjusted on the attacker’s system to reduce user-facing indicators. No Zoom security features were bypassed; automation was achieved entirely via local scripting and configuration.

Technical Mitigations and Operational Recommendations

To enhance defenses against similar intrusions, organizations should prioritize a layered security posture that blends network telemetry, endpoint visibility, and execution control. The following recommendations represent practical and scalable mitigations based on the observed TTPs.

Network Visibility & ARP Abuse Detection
Organizations should deploy network detection tools capable of identifying anomalous ARP activity. Traditional logs often lack visibility into ARP-layer behavior, so it’s essential to collect data from network infrastructure using NetFlow, IPFIX, or SPAN/TAP-based sensors.

• Use tools like Extrahop or Zeek to monitor for abnormal ARP traffic or relay behavior, such as unexpected ARP requests/replies or protocol misuse.
• Augment with EDR/XDR solutions that provide network-layer telemetry at the host level.

Control and Monitor WebSocket Communications
Outbound WebSocket connections should be tightly managed, especially from the data center or developer endpoints.

• Deploy next-generation firewalls with application-layer inspection.
• Utilize web proxy solutions to restrict unknown WebSocket destinations.
• Enforce least privilege access and allow only known, business-critical WebSocket traffic.

Internal Segmentation and Communication Minimization
To prevent lateral movement, organizations should restrict unnecessary peer-to-peer communication.

• Use micro-segmentation and host-based firewalls.
• Implement Zero Trust Network Access (ZTNA) to isolate internal systems.

Advanced Endpoint Detection and Device Control
Modern EDR solutions should support behavioral detection of synthetic HID input and abnormal device interactions. While maintaining a complete inventory of HID hardware may not be feasible, MDM-integrated device control can enhance visibility.

• Tools like Microsoft Intune or JAMF can:
  •  Block unauthorized HID devices
  •  Monitor USB connections
  •  Provide alerting on peripheral anomalies

USB Monitoring and OS Telemetry
USB access should follow a “block-all-except-allow-list” model on high-risk systems.

• Leverage native OS logs for visibility:
  • Windows Event ID 20001–20003 (Intune Device Control)
  • Sysmon Event ID 1 and 11 (process creation, device access)
  • Audit logs for removable storage

Application and Script Execution Control
Where possible, implement allow listing through WDAC or AppLocker. In environments where allow listing is not practical:

• Use EDR platforms with script control modules to detect or prevent unauthorized Python or shell execution.

ARP Spoofing and Packet Relay Protection
ARP-based attacks can be mitigated through a combination of infrastructure and detection controls:

• Enable Dynamic ARP Inspection (DAI) on network switches.
• Set static ARP entries for high-value infrastructure.
• Monitor ARP anomalies using NDR and EDR solutions.
• Use segmentation to limit lateral movement paths.

Threat Hunting and Behavioral Analysis
Proactively hunt for unusual patterns in ARP and WebSocket activity.

• Investigate WebSocket connections to unfamiliar IPs/domains.
• Review ARP broadcasts and identify volume spikes or anomalous MAC/IP pairings.

Note: Some recommendations may require phased implementation depending on resourcing and operational constraints. Focus initial efforts on:

• High-risk user groups (e.g., contractors, IT staff)
• High-value assets (e.g., source code repositories, privileged systems)
• Points of external exposure.

Conclusion

This incident highlights how low-complexity tools can be composed into highly effective, evasive malware. By abusing ARP for signaling, WebSockets for command-and-control, and Zoom for remote access, the attacker circumvented traditional detection at every step, without ever deploying conventional malware.

The most striking element of this case is that the adversary didn’t break in. They were let in, posing as a legitimate employee. This underscores a growing risk in modern environments: attackers don’t always exploit code, they exploit trust.

To stay ahead of these threats, defenders must expand their detection lens to include protocol-layer anomalies, benign tool abuse, and user behavior that appears legitimate on the surface. Advanced visibility is essential to countering threats that hide in plain sight.