U.S. Issues International Warning on North Korean Undercover Scheme

The United States together with Asian and European allies issued an alert on Friday, warning companies against employing undercover North Korean IT workers. It comes as their labor is believed to generate crucial foreign currency to fund Pyongyang’s nuclear weapons program.

In addition to the United States, other countries issuing the alert included Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom.

“North Korea relies upon a network of skilled Information Technology (IT) workers, deployed within and outside of North Korea, to obtain false identities and remotely earn income to fund North Korea’s unlawful nuclear weapons and ballistic missile programs,” read a joint statement issued by the countries.

“These workers seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information. North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally,” the statement added.

The signatory countries have repeatedly warned the international community about the threat North Korean IT workers poses to companies, governments, and individual citizens.

All United Nations Member States are obliged by law to repatriate all North Korean Nationals earning an income in that Member State’s jurisdiction, with few exceptions. Employing them can also violate domestic laws in many countries, including the United States and Japan.

The Financial Action Task Force has called for countermeasures to protect other countries’ financial systems from North Korean money laundering, terrorist financing, and to prevent its nationals from obtaining revenue that would support they state’s weapons of mass destruction.

The international warning issued on Friday highlights a growing dimension of North Korea’s sanctions evasion strategy: using cyber-enabled labor operations to generate revenue for state priorities. As Pyongyang faces restrictions on traditional trade and finance channels, overseas IT employment networks have become a key tool for acquiring foreign currency while simultaneously expanding cyber access and intelligence-gathering opportunities. The involvement of multiple U.S. allies reflects increasing coordination among governments to disrupt illicit financial flows supporting North Korea’s weapons development.

The issue demonstrates that the modern security challenges extend beyond missiles and nuclear tests. North Korea’s digital workforce represents a hybrid threat combining cyber operations, economic warfare, and strategic financing. Countering these networks will require stronger private-sector screening, intelligence sharing, and international enforcement cooperation.