Canada, allies warn North Korea IT workers pose ‘insider threat’ abroad

Canada and 10 of its closest allies issued a warning Friday that North Korean IT workers pose an “insider threat” by remotely obtaining work and income abroad to fund the rogue regime’s nuclear and ballistic weapons programs.

The joint advisory says the remote worker scheme is part of a broader effort to evade international sanctions, and urged countries and companies to “deepen their understanding” of the tactics used and implement measures to counter them.

It adds North Korea “has increased connectivity with the international financial system through diversified revenue generation activities, including IT worker schemes,” despite those sanctions and efforts to strengthen them.

Global Affairs Canada and the RCMP were joined by foreign affairs departments and police forces from its Five Eyes partners Australia, New Zealand, the U.S. and the U.K., along with South Korea, Japan, France, Italy, Germany and the Netherlands.

2:59
North Korea says it would never give up nuclear weapons, pushes ahead with artillery

According to the advisory, North Korean IT workers will falsify their nationality or identity to register for online accounts and seek employment.

The workers are “increasingly likely” to use third-party proxies to create those accounts on their behalf, as well as participate in job interviews “and even establish in-person contact to create a false sense of trust and obtain work contracts,” the advisory adds.

“North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally,” it says.

“These workers seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”

Once employed, the North Korean IT workers will often attempt to avoid being paid by direct deposit and instead request payment through either money transfer or cryptocurrency. The advisory says third-party bank accounts are sometimes used to receive payments, which are then transferred by a proxy to a designated foreign account for a fee.

The advisory notes the workers have “high-level” IT skills and are seeking work in wider areas, including web page and mobile app development, software and blockchain services.

1:20
North Korea has stolen US$1.2B through hacking since 2017: Park Jin

It adds that North Korean IT workers may also use VPNs and other software tools to conceal their true location or run “laptop farms” that receive company-provided laptops for workers to access remotely. Workers often reside in North Korea, China, Russia, and Southeast Asian and African countries.

Last year, an American woman pleaded guilty to federal charges and was sentenced to eight and a half years in prison for operating a “laptop farm” on behalf of North Korean IT workers, which U.S. prosecutors said generated over US$17 million in illicit revenue over a number of years.

Officials in the U.S., Canada, South Korea, Japan and other allies have been warning about the North Korean IT worker scheme since at least 2022. Friday’s advisory points to several warnings issued last year alone, with the scheme detailed in reports by the UN-mandated Multilateral Sanctions Monitoring Team and the G7’s Financial Action Task Force.

Companies with online platforms are advised to be on the lookout for the following characteristics, particularly if several of them apply to a single worker seeking employment:

• Frequent changes to account information, contact details and banking info;
• Mismatched names on an applicant’s bank account;
• Multiple accounts created with the same ID document;
• The appearance of forged or altered ID documents;
• Multiple accounts registered from a single IP address;
• A single account accessed from multiple IP addresses in a short period of time;
• An account remains logged in for an “unusually long” time period;
• Unnaturally high cumulative work hours or related metrics; and
• False reviews posted by a user to boost their account’s rating.

Human resources and hiring departments are also advised to watch for these warning signs:

• Errors or “unnatural expressions” in an account profile “that appear to be the result of inaccurate machine translation”;
• Manipulated or artificially generated video feeds, photo ID mismatches and other discrepancies during video conference meetings;
• Refusal to participate in video conference meetings;
• Offers to work at below-market rates;
• Signs that an account is being operated by multiple individuals depending on the time of day; and
• Requests for payment in cryptocurrency.

The advisory adds that North Korean IT workers participating in a remote work scheme often operate in teams.

It notes that UN member states are required to repatriate any North Korean nationals earning income in that country’s jurisdiction.

“Additionally, contracting with North Korean IT workers and paying them for services rendered may also violate the domestic laws of many countries, including Japan, the United States, and the Republic of Korea, and may result in legal consequences or financial penalties,” the advisory says.