Suspected N. Korean IT worker found at S. Korean firm under false identity for 1st time

Police are investigating North Korean information technology (IT) workers suspected of taking jobs at a South Korean company under false identities, the first time authorities have disclosed such a case.

The case raises concern that wages earned through such employment are funding Pyongyang’s weapons development, amid a recent large-scale U.S. crackdown on similar remote employment fraud.

Police said Thursday that they independently detected one suspected case last year in which a North Korean IT worker fraudulently took a job. The worker was reportedly hired by a private South Korean company and carried out development work. Police are tracing the amount and method of payments while also probing possible organized links.

North Korean IT workers are increasingly landing remote jobs at global companies under forged identities and with fast-evolving artificial intelligence (AI) tools, funneling their earnings to Pyongyang.

In July, 11 countries, including South Korea, the United States and Japan, issued an alert warning that North Korea relies on a network of skilled IT workers to fund its nuclear weapons and ballistic missile programs.

“North Korean IT workers impersonate nationals of other countries to obtain work and income through online platforms operated by private companies for employment, procurement, and contracting of services,” the alert said, adding that the workers are using increasingly sophisticated methods, including AI, to hide their identities and expand their activities globally.

The alert added that the workers also pose an insider threat to companies by engaging in data exfiltration, cryptocurrency theft and theft of sensitive information.

In April, a video went viral showing a suspected North Korean applicant with a false identity being asked to insult North Korean leader Kim Jong-un, a test based on Kim’s status as a sacred figure in the country.

In the video, the applicant was asked to insult Kim with words like “fat ugly pig.” He pretended not to understand, then ended the call.

Earlier this month, the U.S. Department of Justice announced the results of a joint crackdown targeting remote employment fraud by North Korean IT workers. Authorities uncovered “laptop farms” that receive company-provided laptops for the workers to access remotely, concealing their true location.

"North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs," Assistant Director Brett Leatherman of the FBI's Cyber Division said.

Authorities searched more than 40 suspected laptop farm sites in Texas and seized about 187 laptops and other devices in connection with a scheme that victimized more than 70 U.S. companies.

“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas.

“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability,” Raybould added.