North Korean IT workers pose insider threat, allies warn

The United States and 10 Asian and European allies warned companies Friday against employing North Korean IT workers, saying the workers use false identities to earn foreign currency for Pyongyang's nuclear weapons and ballistic missile programs and can threaten company data.

The joint alert was issued by the United States, Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom.

It said North Korean IT workers impersonate nationals of other countries to obtain online platform work and send money to government agencies. The alert said the workers are involved in data exfiltration, cryptocurrency theft and theft of sensitive information.

The alert also said the workers use AI tools to hide their identities, along with proxies in third countries, falsified documents, VPNs, remote desktop software and cryptocurrency payment accounts.

It said many workers operate from North Korea, China, Russia and southeast Asian countries while obscuring their locations. North Korea's nuclear weapons and ballistic missile programs are barred under UN Security Council sanctions; Pyongyang says it has a right to them and enshrined its nuclear status in its constitution in 2023.