DPRK operatives infiltrate healthcare via forged identities and KVM hardware

North Korean IT workers tied to Famous Chollima and PurpleDelta have shifted from software roles into healthcare and sales positions at Western firms. The scheme relies on remote hires who perform real work while routing funds to Pyongyang's weapons programs through stolen identities, VPNs, and laptop farms monitored via PiKVM switches. Three employees at one Australian healthcare company triggered detection through repeated proxy connections and anomalous residence documents during onboarding. A separate sales hire at a financial services firm had PiKVM installed days before a Guermok card appeared, enabling webcam spoofing in Zoom calls. Recorded Future tracked one cluster submitting applications to over 1,100 companies, with healthcare and biotechnology now ranking among top targets alongside staffing firms. This marks a deliberate move into sectors holding sensitive personal and medical data rather than purely technical environments. Official statements emphasize background checks at hiring, yet the operational pattern shows workers succeeding because they deliver acceptable output while masking location and identity. Procurement records and contractor reports indicate sustained state funding for these identity pipelines. Defenders must now treat new hires as potential remote access points requiring hardware attestation and continuous behavioral monitoring rather than one-time verification. Expansion into regulated industries will likely trigger mandatory reporting rules and cross-border data sharing mandates within twelve months.