Eleven nations—including Germany, the US, Japan, France, the UK, and South Korea—have issued a joint warning regarding North Korean IT specialists who are operating worldwide as remote workers under false identities. The German Federal Foreign Office announced this on Friday afternoon.

According to the participating governments, the income generated by these North Korean individuals is used to fund the country's nuclear and missile programs. At the same time, these individuals pose a significant cyber and security risk to companies.

North Korean IT specialists frequently pose as nationals of other countries, use forged identification documents, and employ intermediaries to set up online accounts or conduct job interviews.

They primarily work in fields such as software development, mobile applications, and blockchain technology, and prefer to be paid via cryptocurrency or third-party accounts. They conceal their actual location using VPNs, proxy servers, or so-called "laptop farms."

The nations point out that North Korean IT workers not only generate income but can also be responsible for data theft, the theft of cryptocurrencies, and the exfiltration of sensitive corporate information.

Furthermore, they are increasingly using artificial intelligence to make their false identities more convincing. The advisory lists numerous red flags that may indicate fraudulent applicants. These include frequent changes to account details, forged ID documents, multiple accounts using the same identity verification, unusual IP patterns, and suspicious activity on online platforms.

Suspiciously low salary demands

Warning signs for applicants include, among other things, poor language skills, manipulated or refused video interviews, unusually low salary demands, team collaboration via a single account, and requests for payment in cryptocurrency.

The signatory states call on governments, companies, and online platform operators to tighten their identity verification processes, consistently conduct in-person interviews, and identify suspicious accounts at an early stage. The goal is to hinder the financing of North Korean weapons programs and better protect companies from cybercrime.

In accordance with UN Security Council Resolution 2397, all United Nations member states must repatriate all North Korean nationals earning income within their territory, with a few exceptions.

ekö

‍