Farnsworth Intelligence lists IP addresses allegedly used by North Korean IT-worker farms to connect into U.S. companies through remote desktop tooling, including RustDesk and AnyDesk-style access. The source warns that the operators also abuse legitimate collaboration platforms such as Webex and Microsoft Teams take-control features, which can make activity harder for endpoint tools to distinguish from normal remote support. It recommends filtering for the listed IPs and known AstrillVPN ranges, watching for work-hour connections from high-risk geographies, and adding stronger in-person or video identity checks for remote hires.