A coalition of government agencies from the United States, Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand, and the United Kingdom issued a joint alert on Jul. 31 warning countries and companies about the activities of North Korean Information Technology (IT) workers who are earning income abroad to fund North Korea’s nuclear weapons and ballistic missile programs.
According to the alert, North Korean IT workers obtain false identities and impersonate nationals of other countries to secure remote employment through online platforms. The income generated is remitted back to parent agencies in North Korea. The document states that these individuals pose insider threats by engaging in data exfiltration and cryptocurrency theft. Their methods have become increasingly sophisticated with the use of artificial intelligence to hide their identities.
The participating governments said they have repeatedly warned both public and private sectors about this threat, referencing previous actions such as an August 2025 joint statement by Japan, the United States, and South Korea; a report from October 2025 by the Multilateral Sanctions Monitoring Team on sanctions evasion; and advisories from several countries regarding risks posed by these workers.
The alert highlights that under UN Security Council Resolution 2397, all member states are required to repatriate North Koreans earning income within their jurisdictions unless exceptions apply. Contracting with or paying these IT workers may violate domestic laws in multiple countries including Japan, South Korea, and the United States—potentially resulting in legal or financial penalties.
The Financial Action Task Force has identified North Korea as a high-risk jurisdiction subject to enhanced scrutiny due to money laundering and proliferation financing concerns. The group calls for robust financial sanctions consistent with relevant UN resolutions but notes that North Korea continues generating revenue through schemes involving IT worker deployments worldwide.
Authorities urge companies operating online platforms to strengthen identity verification procedures—such as strict document review or requiring in-person interviews—and improve detection systems for suspicious accounts. They also provide detailed descriptions of tactics used by suspected North Korean IT operatives including use of proxies for account registration or payment receipt; frequent changes in account information; preference for payments via cryptocurrency; forged identification documents; errors indicative of machine translation on profiles; reluctance toward video meetings; low-rate job offers below market value; and signs suggesting team-based operation behind individual accounts.