Nations take action on North Korean IT workers after UN report

Multiple countries have taken legal action against North Koreans or local handlers following a report from the United Nations about Pyongyang’s illicit IT worker scheme. The Multilateral Sanctions Monitoring Team (MSMT) – a U.S.-led international committee – released a new report on Wednesday, expanding on a previous October study.

What happened

North Korea has been deploying IT workers abroad for years, generating an estimated $800 million annually. These workers operate in various sectors across numerous countries, including China and Russia, often facilitated by local brokers and companies. The MSMT report indicates that North Korean IT workers are facing “stricter and increased surveillance by Chinese authorities” and several arrests for alleged espionage.

In China, the situation has become particularly tense, with reports of IT workers being detained for allegedly stealing military secrets. To circumvent restrictions, North Korean companies have resorted to increasingly sophisticated methods, such as leasing buildings in border cities like Sinuiju to allow workers to access Chinese internet and earn foreign currency without entering China, and disguising IT workers as trading company employees.

Laos has also been actively addressing the issue, creating a national committee to investigate the scheme and implement UN rules. Due to increased surveillance, North Korean workers were moved from Vientiane to a provincial city, Vang Vieng. The report notes that North Korea relies on a web of both local facilitators and its own government officials to manage the workers and send earned money back to Pyongyang.

Argentina opened an investigation into Antonia Doroganova, who allegedly helped launder funds earned by North Korean IT workers. Pakistan detained Syeda Aliya Batool Zaidi, a forger providing fraudulent identification documents, and two other individuals involved in facilitating North Korean IT work.

Technical details

• **Affected Products/Vendors:** Not applicable – this is a policy and enforcement issue, not a product vulnerability.
• **CVE/CWE Identifiers:** Not applicable.
• **Attack Vector:** Exploitation of human vulnerabilities (facilitators, brokers, companies) and legal loopholes.
• **Exploitation Status:** Ongoing – relies on human activity and legal processes.
• **CVSS Score:** Not applicable.

Impact

North Korea generates up to $800 million annually through this scheme, with a significant portion of earnings confiscated by North Korean officials. The scheme poses a significant threat to national security in countries hosting North Korean workers, particularly in China and Russia, due to concerns about espionage and intelligence gathering. The report highlights the lengths North Korea’s government is willing to go for hard currency.

What to do

• **Sanction Facilitators:** Identify and sanction local brokers and companies involved in facilitating the scheme.
• **Strengthen Border Controls:** Enhance border security and monitoring to prevent the entry of North Korean workers.
• **Investigate and Prosecute:** Investigate and prosecute individuals involved in facilitating the scheme.
• **Monitor and Disrupt:** Continuously monitor and disrupt North Korean IT worker activities.

Why it matters

The report underscores the ongoing efforts to combat North Korea’s illicit activities and the significant financial resources it relies on to sustain its regime. The scheme represents a serious threat to national security and highlights the need for continued international cooperation to disrupt this network and prevent further exploitation.