#Sanctions #ITWorker

dprk_it_workers_joint_alert_ko.hwp (92 KB)

dprk_it_workers_joint_alert_original.pdf (568 KB)

mofa_dprk_it_workers_press_release.pdf (98 KB)

mofa_dprk_it_workers_press_release.hwpx (101 KB)

North Korean IT workers use forged identities and third-country proxies to obtain remote jobs and remit salaries to DPRK agencies that support nuclear and ballistic missile programs. The joint alert says they may pose insider risks involving data exfiltration, cryptocurrency theft, and sensitive-information theft while using AI, VPNs, remote desktop tools, and overseas laptop farms to hide their identities and locations. Red flags include reused identity documents, mismatched payee names, frequent profile changes, shared or rapidly changing IP addresses, manipulated video, team-operated accounts, and requests for cryptocurrency payment. Participating governments urge stronger identity verification, in-person interviews, anomalous-account detection, and compliance with UN Security Council Resolution 2397 and applicable sanctions.