Japan, South Korea Take Aim at North Korean IT Worker Scam

Japan, South Korea and the United States have stepped up cooperation to counter North Korean operatives posing as IT workers, who—according to Google’s Threat Intelligence Group (GTIG)—have expanded their reach across Asia and into Europe. A joint forum held on 26 August in Tokyo saw updated advisories issued by Japan and South Korea, while the United States sanctioned four entities for roles in the IT worker fraud schemes.

The US Treasury Department stated that the four entities acted as fronts for the North Korean government to facilitate the transfer of at least $1.6 million to the regime. Ashley Zaya of GTIG emphasised that the main goal of these operations is revenue generation for the regime, with risks including theft of IP, data and funds. The scheme relies on thousands of operatives, including those who run laptop farms and launder payroll through front companies, with one operative reportedly maintaining 10 identities.

The Japanese government has warned companies to verify identities and asked freelance-platform providers to bolster anti-fraud measures, as authorities note that DPRK actors often hide their location using VPNs or remote desktop services.