THREAT HUNTING FOR MALICIOUS IP-KVM USAGE

Summary from the TLDR InfoSec newsletter

IP-KVM devices like PiKVM let remote operators drive a machine at the hardware layer with input indistinguishable from a local user, a tactic North Korean IT workers used to control laptop farms. Nebulock's hunt guide treated its sparse-peripheral and onboarding-timing heuristics as triage signals rather than attribution, since product strings and VID/PIDs can be spoofed. Threat hunters should search USB telemetry for known KVM vendors, then flag rare composite HID devices that also expose storage, networking, or video, and correlate hits with new-hire timing and identity anomalies before escalating to physical inspection.