Western allies warn North Korean IT workers funding nuclear arsenal

In a joint statement issued on Friday, 19 government agencies across nine countries cautioned that Pyongyang is relying on IT operatives deployed in North Korea and globally to obtain work under stolen identities to generate illicit revenue, which is then used to fund the country’s prohibited nuclear weapons and ballistic missile programmes.

The statement, which was signed by the United States, South Korea, Japan, and the United Kingdom among others, added that artificial intelligence is being implemented to expand Pyongyang’s network of fraudulent remote IT workers.

It also warned that these workers represent an espionage threat and a source of cybercrime.

North Korea has long insisted on its right to nuclear weapons and ballistic missile programmes, despite them being forbidden under UN Security Council resolutions. It enshrined its nuclear status in its constitution in 2023.

Facing a barrage of international sanctions, Pyongyang is believed to operate widespread cybercrime, cryptocurrency theft, and money laundering activities to bankroll its military ambitions.

Friday’s advisory highlighted that North Korean IT workers routinely obtain remote employment on online freelancing and hiring platforms by impersonating foreign nationals and remitting their paycheques directly to state agencies.

Officials emphasised that North Korean IT workers pose an escalating insider security threat to global firms, engaging in corporate data exfiltration, cryptocurrency theft, and sensitive information espionage.

“North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally,” the coalition said, urging private sector hiring platforms and employers to significantly strengthen identity verification procedures.

According to the advisory, operatives frequently rely on overseas facilitators in North Korea, China, Russia, and Southeast Asia to establish “laptop farms,” which house company-issued devices that North Korean workers access remotely via VPNs to mask their true locations.

The coalition, which also includes France, Germany, Italy, the Netherlands, and New Zealand, builds on previous advisories issued by Washington and its allies, urging global companies to immediately tighten identity verification and hardware vetting processes.