North Korean IT workers, often called “IT warriors,” have significantly expanded their fraudulent operations beyond the United States to target organizations across Europe. These operatives conceal their true identities and pose as remote workers from other countries to secure freelance IT positions worldwide, generating revenue for the North Korean regime.
## European Expansion
According to Google Threat Intelligence Group (GTIG) researchers, North Korean IT operatives have increasingly targeted companies in Germany, Portugal, and the United Kingdom after facing charges and sanctions in the United States.
“DPRK IT workers employed deceptive tactics, falsely claiming nationalities from countries including Italy, Japan, Malaysia, Singapore, Ukraine, the United States, and Vietnam,” explained Jamie Collier, lead threat intelligence advisor at GTIG. “The identities used were a combination of real and fabricated personas.”
These workers recruit through online platforms such as Upwork, Telegram, and Freelancer, receiving payment via cryptocurrency, TransferWise, and Payoneer to obscure the money trail.
## Sophisticated Deception
GTIG investigators discovered user credentials on European job websites linked to North Korean personas seeking employment at German and Portuguese companies. In the UK, these workers have been connected to projects involving AI, blockchain, web development, and content management systems.
Some operatives have targeted defense and government organizations using fabricated references to deceive recruiters. Michael Barnhart, a Mandiant Principal Analyst, noted: “We are increasingly seeing North Korean IT workers infiltrating larger organizations to steal sensitive data and follow through on extortion threats.”
## International Response
In September 2024, the UK’s Office of Financial Sanctions Implementation issued an advisory warning that hiring these workers could breach financial sanctions.
The FBI has repeatedly warned about North Korea’s IT worker scheme, which has tricked hundreds of companies worldwide. The North Korean regime reportedly keeps up to 90% of wages collected, generating hundreds of millions annually to fund weapons programs.
After being discovered, some workers have extorted former employers by threatening to leak stolen sensitive information.
## Enforcement Actions
In January, the U.S. Justice Department indicted two North Korean nationals and three facilitators involved in a fraudulent remote IT work scheme affecting at least 64 U.S. companies. The Treasury’s Office of Foreign Assets Control sanctioned North Korean front companies linked to the Ministry of National Defense.
The U.S. State Department now offers millions for information disrupting these fraudulent activities. South Korean and Japanese government agencies have also issued alerts about these deceptive employment practices.