US, allies issue alert on North Korea IT workers

The United States and 10 Asian and European allies on Friday warned companies against employing North Korean IT workers whose labor was generating crucial foreign currency to fund Pyongyang's nuclear weapons program.

In a joint statement, they said the country was using skilled workers under false identities "to fund North Korea's unlawful nuclear weapons and ballistic missile programs."

In addition to the United States, other countries issuing the alert included Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom.

North Korea has long insisted on its right to nuclear weapons and ballistic missile programs, although they are forbidden under the terms of UN Security Council sanctions. It enshrined its nuclear status in its constitution in 2023.

The country faces a slew of international sanctions over its weapons and nuclear programs. It is believed to operate widespread cybercrime, cryptocurrency, and money laundering activities to fund them.

Friday's alert said that North Korean IT workers were impersonating nationals of other countries to obtain work and income on online platforms, and remit the money to government agencies.

"They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information," the alert said.

It warned that North Korean workers were using AI tools to further obscure their true identities.

The United States, Japan, South Korea, the United Kingdom, Australia, and Canada have all issued earlier advisories against employing North Korean IT workers.

The alert listed typical methods used by such workers to hide their identities, including using proxies in third countries, falsifying documents and using cryptocurrency accounts for payment that are harder to track than standard bank accounts.

It said many of the workers were working from North Korea, China, Russia and southeast Asian countries, but would obscure their location using VPNs and remote desktop software.