Canada and 10 of its allies have issued a warning that North Korean IT workers are obtaining employment as remote workers at tech companies and then using the income to fund the regime’s weapons programs.
The advisory said these workers “pose an insider threat to companies” and can be involved in the theft of data and cryptocurrency. “North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally,” the advisory said.
The North Korean IT workers will typically falsify their identities and use forged documents or impersonate others. They will also request payment via money transfer services or cryptocurrency instead or via direct deposit.
The IT workers often possess high-level skills in IT-related work, and seek employment in web development, in mobile application development, and around blockchain applications. While many of the workers reside in North Korea, some are based in China, Russia, or African and Southeast Asian countries.
The joint advisory says this remote worker scheme is part of a broader effort by Pyongyang to evade international sanctions. It urged countries and companies to “deepen their understanding” of such tactics and implement measures to counter them.
The advisory said companies operating online should use enhanced identity verification procedures, such as more stringent reviews of identification documents and the requirement for in-person interviews.
Companies should also be on the lookout for frequent changes to registered information, multiple accounts being created using the same identification document, multiple accounts being accessed from the same IP address, and the account remaining logged in for an unusually long amount of time.
Human resources departments should also watch for “unnatural expressions” in an account profile that “appear to be the result of inaccurate machine translation,” AI-generated video feeds, refusals to participate in video conference meetings, offers to work at below-market rates, and signs that an account is being operated by multiple people.
The advisory was put out by Global Affairs Canada and the RCMP, as well as foreign affairs departments and police forces from the United States, United Kingdom, Australia, New Zealand, South Korea, Japan, France, Italy, Germany and the Netherlands.
The advisory notes that according to UN Security Council Resolution 2397, passed in 2017, all countries must repatriate any North Korean nationals earning income in their jurisdiction.
