North Korean laptop farms turn remote hiring into a privileged-access…Microsoft disrupts the service market behind a billion malicious…Exploited Windows Shell flaw defeats a core file-trust signalIvanti exploit chain reached root on a fully patched VPN appliance
North Korean laptop farms turn remote hiring into a privileged-access risk
A federal operation exposed the scale of a remote-worker scheme that placed North Korean personnel behind apparently legitimate identities, employer-issued laptops and trusted corporate accounts.
Security.io Intelligence Desk · Thursday, 15 October 2026
Executive consequence
The U.S. Department of Justice announced searches of more than 40 Texas residences and the seizure of 187 laptops and KVM devices used in laptop farms supporting North Korean remote IT workers. Reporting said at least 70 U.S. companies were infiltrated.
Decision today
Re-screen remote hires and contractors against the DOJ-published accounts and device-shipping records.
CVE-2026-96951 is an actively exploited Windows Shell command-injection vulnerability that can bypass Mark of the Web. Microsoft released a fix, and reporting said CISA added the flaw to its Known Exploited Vulnerabilities catalogue with an October 16 federal deadline.
Do today
Deploy Microsoft’s October security update to supported Windows systems handling external content.
A previously undocumented operator tracked as UTA0576 chained three Ivanti Connect Secure zero-days to obtain unauthenticated root-level execution on a fully patched appliance.
Do today
Inventory internet-facing Ivanti Connect Secure appliances and map each appliance to its software branch.
Booz Allen reported eight controlled OT scenarios in which the tested AI systems met every defined objective. One scenario moved from a perimeter compromise to actions inside an industrial control network in just over 16 minutes; another moved a robotic arm.
Do today
Add AI-enabled traversal to OT threat models and consequence scenarios.