On July 31, South Korea, the U.S., Japan, and eight other nations issued a joint advisory to counter North Korean information technology (IT) workers’ illicit foreign currency earnings and cyber threats.
The South Korean Ministry of Foreign Affairs and National Police Agency announced the release of this advisory in collaboration with agencies from allied countries, including the U.S., Japan, UK, Australia, Canada, France, Germany, Italy, the Netherlands, and New Zealand.
This joint effort aims to alert the international community and private sector about the tactics employed by North Korean IT operatives and prevent their recruitment.
The advisory reveals that North Korea deploys skilled IT personnel domestically and abroad to work remotely under false identities. The regime then funnels the profits into its nuclear and ballistic missile programs.
North Korean IT workers have been known to pose as third-country nationals on online job platforms to secure contracts. They also engage in internal threats such as data breaches, cryptocurrency theft, and sensitive information leaks. Intelligence suggests they’ve recently begun leveraging artificial intelligence (AI) to create more sophisticated false identities.
The participating nations cautioned that compensating North Korean IT workers could violate UN Security Council Resolution 2397 and domestic laws, potentially resulting in legal and financial penalties. They also noted that the Financial Action Task Force (FATF) has identified these activities as a means of funding weapons of mass destruction development.
The advisory urges companies and online platform operators to bolster identity verification processes and implement systems to flag suspicious accounts. It outlines key indicators of North Korean IT operatives, including the use of forged identifications (IDs) and third-country proxies to create accounts, masking actual work locations through virtual private networks (VPNs) and remote access tools, operating laptop farms, and requesting payment in cryptocurrency.
A spokesperson for the South Korean Ministry of Foreign Affairs stated that its government has been working closely with international partners to counter North Korea’s malicious cyber activities. It remains committed to fostering a secure cyberspace through continued global cooperation and public-private partnerships.