US, allies warn North Korean IT workers, funding Pyongyang’s weapons programmes

The United States and its allies have issued a joint warning over a growing cyber threat posed by North Korean IT workers who allegedly use fraudulent identities, remote employment schemes and cyber theft to generate revenue for Pyongyang’s banned nuclear and missile programmes.

The alert, released on Friday (July 31) by the US Department of State and the Federal Bureau of Investigation (FBI), alongside security agencies from Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom, urged governments, companies and online platforms to strengthen measures against North Korean IT worker networks.

According to the statement, North Korea has developed a global network of skilled technology professionals who operate both inside and outside the country, using false identities to secure jobs through online employment, procurement and contracting platforms.

The workers allegedly seek overseas contracts with the aim of transferring their earnings back to North Korean state agencies, helping finance Pyongyang’s nuclear weapons and ballistic missile programmes in violation of international sanctions.

The advisory said North Korean IT workers also pose an insider threat to companies, citing involvement in data theft, cryptocurrency theft and the extraction of sensitive information.

“North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally,” the countries said in the alert.

The warning comes amid growing concerns over Pyongyang’s use of cyber operations and illicit revenue streams to bypass international sanctions. The countries noted that previous advisories had highlighted the risks posed by North Korean IT workers to private companies, governments and individuals.

The statement referenced United Nations Security Council Resolution 2397, which requires member states to repatriate North Korean nationals earning income under their jurisdiction, with limited exceptions. It added that companies hiring North Korean IT workers could face legal consequences or financial penalties under domestic laws in countries including the US, Japan and South Korea.

The advisory also highlighted concerns raised by the Financial Action Task Force (FATF), which lists North Korea as a high-risk jurisdiction subject to enhanced measures. According to the statement, Pyongyang has increasingly used IT worker schemes as part of broader efforts to access the international financial system and generate funds for its weapons programmes.

Governments called on businesses, particularly online employment platforms, to improve identity verification systems, including stricter checks of identification documents, in-person interviews and enhanced monitoring for suspicious accounts.