North Korea IT Workers Pose 'Insider Threat' Abroad, Allies Warn

Canada and 10 allied nations have issued a joint warning concerning North Korean IT workers who pose an "insider threat" by securing employment and income abroad to fund Pyongyang's nuclear and ballistic weapons programs. The advisory highlights that this scheme is a key tactic for North Korea to circumvent international sanctions.

“

North Korean IT workers pose an 'insider threat' by remotely obtaining work and income abroad to fund the rogue regime’s nuclear and ballistic weapons programs.

According to the advisory, these workers often falsify their nationality or identity to register for online accounts and secure jobs. They are increasingly likely to use third-party proxies for account creation and may even participate in in-person interviews to establish false trust and obtain contracts. The advisory notes that North Korean IT workers employ sophisticated methods, including artificial intelligence, to obscure their identities and expand their global activities.

“

North Korea has increased connectivity with the international financial system through diversified revenue generation activities, including IT worker schemes.

Once employed, these workers aim to remit their salaries back to their parent North Korean agencies. They also present an insider threat to companies, participating in data exfiltration, cryptocurrency theft, and the pilfering of sensitive information. Payments are often requested through money transfers or cryptocurrency rather than direct deposit, with third-party bank accounts sometimes used to funnel funds to designated foreign accounts.

“

North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally.

The workers possess high-level IT skills and seek roles in areas such as web and mobile app development, software, and blockchain services. They may use VPNs and other tools to conceal their location or operate "laptop farms" for remote access. These workers are often based in North Korea, China, Russia, and various countries in Southeast Asia and Africa.

“

These workers seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.