Microsoft published patches for 1,417 vulnerabilities on Tuesday. Seventy-six of them are rated critical. One was already being exploited before your coffee cooled. That is a legitimate workday. It is also excellent cover for a slower, ruder fact: in September, federal agents walked through more than 40 Texas residences used as laptop farms for North Korean remote-worker scams. Your cybersecurity calendar called Patch Tuesday the story. The access path was a company laptop on a coffee table, logged in as someone your recruiters believed they had hired.

Two people were arrested. Prosecutors put the take at about $3 million funneled back to the regime. CrowdStrike helped the FBI disrupt a Famous Chollima operation in the same orbit. If you have been filing “North Korean IT workers” under other people’s problems, the raid map should recalibrate you. This is a staffing channel. It pays like a staffing channel. It also hands a sanctioned government a badge, a repo, and whatever your firewall already permits for a trusted remote employee.

The coffee table had better uptime than your VPN

The farm is almost boring once you say it out loud. A facilitator in the United States takes delivery of the corporate laptop. They park it on a desk, a dresser, sometimes a closet shelf with a cheap KVM. The person you interviewed over video is somewhere else, often several time zones away, driving the machine through remote-desktop tooling you already allow because “hybrid work.” Payroll hits a mule account. A cut moves toward Pyongyang. The endpoint looks healthy because it is healthy. Your MDM sees a managed Mac or ThinkPad on a residential ISP. Threat detection sees a named user doing named-user things.

Valid credentials beat a clever exploit. Every time.

Security teams still pour cycles into brute-force noise against VPN and SSH because that traffic is ugly and easy to graph. A laptop farm does not look like that. There is no spray. There is an offer letter, a shipping label, and a first-day Slack message that lands on time. Your threat-protection stack is doing what you paid it to do: watching for malware, odd process trees, and inbound junk. The farm’s trick is to arrive as a colleague. Defense in depth that starts at the perimeter and ends at EDR never gets a vote on who is allowed to sit down.

Texas is not a plot twist. It is logistics. You need a U.S. mailbox, a U.S. face for the rare video check, and a place to keep the hardware inside the country so geolocation and “office of record” checks do not scream. Forty-plus residences in one state is not a hobbyist side hustle. That is a warehouse model wearing HOA landscaping.

Your cybersecurity hiring flow is the actual C2

Famous Chollima has been running this play long enough that you should be tired of pretending it is novel. Stolen or borrowed identities. Coached interviews. Devices that never travel with the human who does the work. Sometimes the job is just a salary. Sometimes the job is source code, internal docs, and a foothold that waits. Either way, cyber security programs that treat HR as a ticket queue are volunteering the keys.

The real problem here is custody. You would not drop-ship a domain controller to an address you have never walked. You do it with employee laptops every week. The box leaves a depot, lands on a porch, and from that moment the “user” is whoever can keep the session alive. Security hardening on the image does not save you if the person holding the keyboard is a committee. Incident response will later ask when the laptop was imaged, which is the wrong first question. Ask who physically received it, who has sat in front of it, and which remote-access tools were installed in the first 48 hours.

This is a bad look for any org that still treats a scanned driver’s license plus a Zoom panel as identity. Document mills exist. Deepfake interviews exist. Time-zone math exists, and it is free. If your new hire’s git commits land at 03:00 local and the “home” IP never leaves Harris County, you do not have a productivity mystery. You have a relay.

Patch Tuesday will still be there tomorrow. 1,417 CVEs will still need owners, and the already-exploited one still needs a war room. None of that inventory work substitutes for knowing whether the human attached to a privileged laptop is a human you actually met.

Pull the laptop before you file the ticket

You do not need a new platform for this. You need a refusal to ship compute to a stranger, plus a hunt that assumes some of those strangers already have seats. Do the ugly inventory first, then change the default path so the next farm has to steal an enrolled device instead of waiting for FedEx.

• Build a 24-month list of every endpoint drop-shipped to a home address for a new hire, contractor, or “body shop” vendor. Match each asset to a live video identity check, a payroll identity, and a typical work-hour timezone. Breaks in that chain get pulled off the network the same day, not parked in a “sync with HR” ticket.
• Stop porch delivery for first machines. Require pickup from a staffed office, a controlled locker with government ID plus a liveness check, or a courier who only releases to the photographed hire. No laptop, no VPN profile, no SaaS seat.
• On first check-in, deny inbound remote-control tools from the internet. If an engineer needs a jump path, they use your broker, from your network, with session recording. Hunt existing fleet for AnyDesk, TeamViewer, Splashtop, Chrome Remote Desktop, and nested RDP that appeared in week one.
• Instrument the boring telemetry: residential IP that never matches the claimed metro, stacked sessions from two continents, webcam disabled for every meeting, and a camera-off “senior” who types like a night-shift crew. Feed those to threat detection as identity events, not wellness nags.
• Give incident response a laptop-farm playbook that includes payroll freeze, device wipe, access-broker review, and a source-code integrity pass. Waiting for malware keeps you polite and late.

Ongoing, treat hiring as an identity provider. Recheck high-privilege remote staff on a cadence. Geofence admin roles. Prefer short-lived credentials over standing VPN. Keep a human in the loop for anyone who touches production, payments, or secrets. Defense in depth here is unglamorous: shipping rules, session policy, and managers who are allowed to say the interview felt rehearsed.

Reply-bait still works, and they know it

While Texas living rooms were getting searched, the same government was still fishing Ukrainians with reply-bait mail for war intel. No implant-of-the-month. A thread that looks like a continuation, a nudge to answer, a document that wants a login. North Korean units in and around that conflict want a picture of their own mess, and they are willing to get it from an inbox because inboxes still talk.

Hold those two pictures together. One operation rents American spare rooms so a remote employee can cash paychecks. The other operation tugs an email thread until someone forwards the wrong attachment. Both assume you are busy. Patch volume helps that assumption. So does a SOC that grades itself on malware caught instead of identities verified.

You already know how to read a CVE. Read a shipping label with the same suspicion. If the machine never met the engineer, you did not hire a person. You stood up a relay, and someone else is billing you for the privilege.

Sources

• Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
• U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
• October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
• North Korea Phishes Ukrainians for War Intel